[Live-devel] two security fixes for live555?

[Ross Finlayson]

Thanks, but neither of these are needed.

First, the ability of the “LIVE555 Media Server” to stream files that are outside of the directory from which it is run is a ‘feature’, not a bug.  See:
	http://lists.live555.com/pipermail/live-devel/2026-June/022803.html

Second, 'CVE-2019-7732’ is bullshit.  (I don’t think the author(s) of this ever contacted us before publishing this.)  The function “parseAuthorizationHeader()” already initializes these values to NULL; note the line
	username = realm = nonce = uri = response = NULL;
on line 1054 of “RTSPServer.cpp”.  And this (static) function is called only within "RTSPServer::RTSPClientConnection
::authenticationOK()”, which sets all of the actual parameters to NULL before calling "parseAuthorizationHeader()” (see lines 1112-1113 of “RTSPServer.cpp”).

(Also, this ‘CVE’ was published based not on our code, but on some rando’s modified copy of our code on GitHub; this code should *not* be used - see http://live555.com/liveMedia/faq.html#latest-version )


Ross Finlayson
Live Networks, Inc.
http://www.live555.com/