Description
Integer overflow in the RTSP_msg_len function in rtsp/RTSP_msg_len.c in Fenice 1.10 and earlier allows remote attackers to cause a denial of service (application crash) via a large HTTP Content-Length value, which leads to an invalid memory access.
References
- 19770 third-party-advisory
- 17678 vdb-entry
- fenice-contentlength-dos(26080) vdb-entry
- http://aluigi.altervista.org/adv/fenicex-adv.txt
- 20060423 Buffer-overflow and crash in Fenice OMS 1.10 mailing-list
- 794 third-party-advisory
- ADV-2006-1491 vdb-entry
- 20060607 Re: Buffer-overflow and crash in Fenice OMS 1.10 mailing-list
- 24882 vdb-entry