CVE-2025-65408

Executive Summary

CVE-2025-65408 is a NULL pointer dereference vulnerability in the ADTSAudioFileServerMediaSubsession::createNewRTPSink() function of Live555 Streaming Media v2018.09.02. An attacker can exploit this flaw by supplying a crafted ADTS (Audio Data Transport Stream) file, causing a Denial of Service (DoS) condition. The vulnerability resides in the media server’s handling of ADTS audio streams, where a NULL pointer is dereferenced during RTP sink creation, leading to a crash. No patch is currently available from the vendor, and no public exploit code has been released. The CVSS score is 0.0 due to incomplete NVD data, but based on the description, the vector indicates a network-accessible, low-complexity attack with no privileges required, resulting in high availability impact.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be triggered remotely by sending a crafted ADTS file.
• Attack Complexity (AC): Low (L) – No special conditions are required; the crafted file is processed directly.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – The attack does not require user action.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – The service crashes, causing a DoS.

Threat Level: Medium (based on DoS impact and lack of patch). The vulnerability is easily exploitable remotely, but the impact is limited to availability.

Deep Dive & Mechanics

The vulnerability is in the ADTSAudioFileServerMediaSubsession::createNewRTPSink() function within Live555 Streaming Media v2018.09.02. This function is responsible for creating an RTP sink for ADTS audio streams. When a crafted ADTS file is supplied, the function attempts to dereference a NULL pointer, likely due to improper validation of the file’s header or stream parameters. The ADTS format includes a fixed header with synchronization bits, but a malformed file can cause the code to access an uninitialized or NULL pointer, leading to a segmentation fault and service termination.

The root cause is a lack of input validation in the createNewRTPSink() function. The function does not check for NULL returns from helper functions that parse the ADTS stream, such as ADTSAudioFileParser::getFrameSize() or similar. When the parser fails to extract valid frame information, it returns NULL, which is then dereferenced without a check.

Vulnerable vs. Patched Code

Vulnerable Code (Live555 v2018.09.02):

// ADTSAudioFileServerMediaSubsession.cpp
RTPSink* ADTSAudioFileServerMediaSubsession::createNewRTPSink(
    Groupsock* rtpGroupsock, unsigned char rtpPayloadTypeIfDynamic,
    CommonPlay* commonPlay) {
    // Assume fSource is set elsewhere
    ADTSAudioFileSource* source = (ADTSAudioFileSource*)fSource;
    // No NULL check on source
    return ADTSRTPSink::createNew(*env(), rtpGroupsock, rtpPayloadTypeIfDynamic,
                                  source->samplingFrequency(), source->numChannels());
}

Patched Code (Hypothetical Fix):

// ADTSAudioFileServerMediaSubsession.cpp
RTPSink* ADTSAudioFileServerMediaSubsession::createNewRTPSink(
    Groupsock* rtpGroupsock, unsigned char rtpPayloadTypeIfDynamic,
    CommonPlay* commonPlay) {
    ADTSAudioFileSource* source = (ADTSAudioFileSource*)fSource;
    if (source == NULL) {
        env() << "Error: NULL source in createNewRTPSink\n";
        return NULL;
    }
    return ADTSRTPSink::createNew(*env(), rtpGroupsock, rtpPayloadTypeIfDynamic,
                                  source->samplingFrequency(), source->numChannels());
}

The patch adds a NULL check before dereferencing the source pointer, preventing the crash.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Deploy Live555 Streaming Media v2018.09.02 on a test server (e.g., Ubuntu 20.04). Ensure the server is configured to serve ADTS files.
2. Craft Malicious ADTS File: Create a malformed ADTS file that triggers the NULL pointer dereference. For example, set the ADTS header’s synchronization word to 0xFFF0 but omit the frame length field or set it to zero.

   # craft_adts.py
   import struct
   # Minimal ADTS header (7 bytes) with invalid frame length
   header = b'\xff\xf0\x00\x00\x00\x00\x00'  # Sync word 0xFFF0, zero frame length
   with open('malicious.adts', 'wb') as f:
       f.write(header)
   

3. Trigger: Send a request to the server to stream the crafted file:

   curl "rtsp://target:554/malicious.adts"
   

4. Observe: The server crashes, resulting in a DoS.

Blue Team (Defense & Detection)

• Monitor: Watch for repeated RTSP requests to ADTS files with unusual headers.
• Harden: Implement input validation at the network perimeter (e.g., WAF) to block malformed ADTS headers.
• Mitigate: If patching is not possible, disable ADTS streaming or restrict access to trusted IPs.

Indicators of Compromise (IOCs)

• Network: RTSP requests with URIs ending in .adts and containing malformed headers (e.g., sync word 0xFFF0 with zero frame length).
• Logs: Server logs showing segmentation faults or crashes in ADTSAudioFileServerMediaSubsession::createNewRTPSink().
• File: Presence of crafted ADTS files on the server (e.g., malicious.adts with invalid headers).
• Process: Crash dump of the Live555 process (e.g., live555MediaServer).

Detection Engineering

YARA Rule

rule CVE_2025_65408_ADTS_Malformed {
    meta:
        description = "Detects malformed ADTS files exploiting CVE-2025-65408"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65408"
    strings:
        $adts_sync = { FF F0 }  // Sync word 0xFFF0
        $zero_frame_len = { 00 00 00 00 }  // Zero frame length
    condition:
        $adts_sync at 0 and $zero_frame_len at 3
}

Sigma Rule

title: CVE-2025-65408 ADTS DoS Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects RTSP requests with malformed ADTS files targeting Live555
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: live555
detection:
    selection:
        cs-method: 'PLAY'  # RTSP PLAY request
        cs-uri-query|contains: '.adts'
        cs-uri-query|contains: 'FF F0'  # Hex encoded sync word
    condition: selection
falsepositives:
    - Legitimate ADTS files with unusual headers (rare)
level: high

Suricata Rule

alert tcp any any -> any 554 (msg:"CVE-2025-65408 ADTS DoS Attempt"; flow:to_server,established; content:"PLAY"; http_method; content:".adts"; http_uri; content:"|FF F0|"; distance:0; within:2; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: No official patch exists. Apply the hypothetical fix by adding a NULL check in ADTSAudioFileServerMediaSubsession::createNewRTPSink().
2. Workaround: Disable ADTS streaming in the Live555 configuration, or use a firewall to restrict access to the RTSP port (554) from untrusted networks.
3. Monitor: Deploy the provided detection rules to identify exploitation attempts.
4. Upgrade: Consider migrating to a maintained fork or alternative streaming solution.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert