How to remediate – RTSP Server Type / Version Detection

1. Introduction

An RTSP (Real Time Streaming Protocol) server is listening on a remote port. This means a service capable of streaming video and audio data over an IP network is accessible. While not directly exploitable in itself, it presents an attack surface for reconnaissance and potential attacks targeting the RTSP service or related components. Systems commonly affected include IP cameras, Network Video Recorders (NVRs), and media servers. A successful attack could lead to information disclosure, denial of service, or remote code execution depending on the server implementation.

2. Technical Explanation

The RTSP protocol allows clients to control streaming media sessions. An attacker can send an OPTIONS request to gather information about the server’s capabilities and name. This is not a vulnerability in itself, but it reveals the presence of the service which could be targeted by further attacks. There are no known CVEs specifically for RTSP detection; however, vulnerabilities often exist within specific RTSP server implementations. An attacker might use this information to identify vulnerable versions or configurations and attempt exploits such as buffer overflows or command injection through crafted requests.

• Root cause: The RTSP service is enabled and responding to external requests.
• Exploit mechanism: An attacker sends an OPTIONS request to enumerate server details, then attempts to exploit known vulnerabilities in the specific RTSP server software. For example, a vulnerable version of Live555 could be targeted with a crafted RTSP command.
• Scope: IP cameras, NVRs, media servers running RTSP services. Specific versions depend on the vendor and implementation.

3. Detection and Assessment

Confirming whether a system is vulnerable involves identifying if an RTSP service is listening. A quick check can be done using network scanning tools. Thorough assessment requires analysing the server’s response to an OPTIONS request.

• Quick checks: Use nmap to scan for port 554, the standard RTSP port.
• Scanning: Nessus plugin ID 10386 can detect RTSP services. OpenVAS has similar checks available. These are examples only and may require updates.
• Logs and evidence: Check firewall logs for connections to port 554 from unexpected sources. Application logs on the server might show RTSP connection attempts.

nmap -p 554 

4. Solution / Remediation Steps

The primary solution is to disable the RTSP service if it’s not required. If needed, ensure the server software is up-to-date with the latest security patches.

4.1 Preparation

• Ensure you have access to restart the service or revert configuration changes. A roll back plan involves restoring the snapshot or reverting the configuration.
• Changes may require a maintenance window depending on the impact and criticality of the system. Approval from the IT security team might be needed.

4.2 Implementation

1. Step 1: Stop the RTSP service if possible. The command varies by operating system; for example, systemctl stop rtsp-server on Linux.
2. Step 2: Disable the RTSP service from starting automatically at boot. For example, systemctl disable rtsp-server on Linux.
3. Step 3: If disabling is not possible, update the RTSP server software to the latest version. Check the vendor’s website for available updates.

4.3 Config or Code Example

Before

# /etc/systemd/system/rtsp-server.service (example)
[Service]
ExecStart=/usr/bin/rtsp-server

After

# /etc/systemd/system/rtsp-server.service (example)
[Service]
ExecStart=/usr/sbin/nologin # or remove the service file entirely

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help mitigate risks associated with exposed services like RTSP. Least privilege reduces the impact of a successful attack by limiting access rights. Safe defaults ensure that unnecessary services are disabled by default. Patch cadence ensures timely updates to address known vulnerabilities.

• Practice 1: Apply least privilege principles; run the RTSP service with a dedicated user account and minimal permissions.
• Practice 2: Implement a regular patch cadence for all software, including RTSP server components.

4.5 Automation (Optional)

If using configuration management tools like Ansible, you can automate the disabling of services.

---
- hosts: all
  tasks:
    - name: Stop and disable RTSP service
      service:
        name: rtsp-server
        state: stopped
        enabled: false

5. Verification / Validation

Confirm the fix by verifying that the RTSP service is no longer listening on port 554. Re-run the initial detection method to confirm it’s gone. Perform a basic smoke test of any dependent services.

• Post-fix check: Run nmap -p 554 and verify that no ports are open.
• Re-test: Re-run the initial nmap scan to confirm port 554 is closed.
• Monitoring: Monitor firewall logs for any unexpected connections to port 554 as an example of regression.

nmap -p 554  # Expected output should show the port is closed

6. Preventive Measures and Monitoring

Update security baselines to include disabling unnecessary services like RTSP. Implement checks in CI/CD pipelines to prevent deployment of systems with exposed ports. Establish a sensible patch or configuration review cycle that fits the risk profile.

• Baselines: Update your security baseline or policy to require disabling unused services, including RTSP.
• Pipelines: Add checks in CI/CD pipelines to scan for open ports and flag systems with exposed RTSP servers.
• Asset and patch process: Review configurations regularly (for example, quarterly) to ensure compliance with security policies.

7. Risks, Side Effects, and Roll Back

• Risk or side effect 2: Incorrect configuration may prevent the service from restarting; document all changes carefully.
• Roll back: 1) Re-enable the RTSP service using systemctl enable rtsp-server and systemctl start rtsp-server. 2) Restore the original configuration file if necessary.

8. References and Resources

• Vendor advisory or bulletin: Check your RTSP server vendor’s website for specific security recommendations.
• NVD or CVE entry: No specific CVE exists for RTSP detection, but search for vulnerabilities related to your specific RTSP server software.
• Product or platform documentation relevant to the fix: Refer to your RTSP server’s documentation for instructions on disabling and