Macromedia Breeze Communication Server and Live Server RTMP Data Validation Vulnerability

Bugtraq ID:	15434
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 15 2005 12:00AM
Updated:	Nov 15 2005 12:00AM
Credit:	Announced by the vendor.
Vulnerable:	Macromedia Breeze 5.1 Macromedia Breeze 5.0 Macromedia Breeze 4.1 Macromedia Breeze 4.0
Not Vulnerable:

Macromedia Breeze Communication Server and Live Server RTMP Data Validation Vulnerability

Macromedia Breeze Communication Server and Live Server do not sufficiently validate RTMP data. Successful exploitation could lead to a denial of service condition.

Macromedia Breeze Communication Server and Live Server RTMP Data Validation Vulnerability

This issue may be exploited with an alpha build of Macromedia Flash Player 8.5 (build 127).

Macromedia Breeze Communication Server and Live Server RTMP Data Validation Vulnerability

Solution:
Fixes are available:


Macromedia Breeze 4.0

• Macromedia fcs_securitypatch_brz40.zip
  http://download.macromedia.com/pub/breeze/updaters/security/fcs_securi typatch_brz40.zip

Macromedia Breeze 4.1

• Macromedia fcs_securitypatch_brz41.zip
  http://download.macromedia.com/pub/breeze/updaters/security/fcs_securi typatch_brz41.zip

Macromedia Breeze 5.0

• Macromedia fcs_securitypatch_brz50.zip
  http://download.macromedia.com/pub/breeze/updaters/security/fcs_securi typatch_brz50.zip

Macromedia Breeze 5.1

• Macromedia fcs_securityinstaller_brz51.exe
  http://download.macromedia.com/pub/breeze/updaters/security/fcs_securi tyinstaller_brz51.exe

Macromedia Breeze Communication Server and Live Server RTMP Data Validation Vulnerability

References:

• Breeze Home Page (Macromedia)
  
• MPSB05-10 Security Patch for Insufficient Validation in Breeze Communication Ser (Macromedia)