Description
librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3_Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA corrupts heap memory and leaks heap bytes.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
RTMPDump librtmp
Default version status: unaffected
0 to ≤ 2.6affected
References
- https://hackmd.io/@haindpwn/librtmp-amf3-decode-and-strict-array-oob ↗
- https://git.ffmpeg.org/gitweb/rtmpdump.git/blob/138fdb258d9fc26f1843fd1b891180416c9dc575:/librtmp/amf.c ↗
- https://rtmpdump.mplayerhq.hu/ ↗
- https://www.vulncheck.com/advisories/librtmp-rtmpdump-through-2.6-heap-out-of-bounds-write-via-amf3-decode ↗