Vulnerability Note VU#460350

Apple Quicktime/Darwin Streaming Server fails to properly parse DESCRIBE requests

The RTSP provides a DESCRIBE method which according to RFC 2326 "retrieves the description of a presentation or media object identified by the request URL from a server. It may use the Accept header to specify the description formats that the client understands. The server responds with a description of the requested resource. The DESCRIBE reply-response pair constitutes the media initialization phase of RTSP."

There is a vulnerability in the way the Quicktime/Darwin Streaming Server parses DESCRIBE requests containing specially crafted User-Agent fields. An attacker could exploit this vulnerability by sending a DESCRIBE request containing an overly large User-Agent field.

II. Impact

Apple has released a patch to address this vulnerability. For further details, please see the Apple Security Advisory (Security Update 2004-02-23).

Systems Affected

http://www.idefense.com/application/poi/display?id=75
http://www.apple.com/support/security/security_updates.html
http://www.ietf.org/rfc/rfc2326.txt

Credit

This vulnerability was reported by iDefense.

This document was written by Damon Morda.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.