Attack Chain

1. Attacker probes TCP port 1935 on the target host.
2. Attacker initiates RTMP handshake (C0/C1) and waits for server response (S0/S1/S2).
3. Attacker sends connect command (AMF0) targeting live, sofia, or default application.
4. Attacker inspects server fmsVer response; if 1, the target is identified as mod_rtmp.
5. Attacker negotiates SetChunkSize 4096 to ensure the payload remains in a single chunk.
6. Attacker sends a crafted RTMP USERCTRL 0x04 message with a payload > 70 bytes.
7. The rtmp_handle_control() function overflows the fixed 200-byte stack buffer, resulting in a process crash.
8. Attacker polls the service port to confirm the listener is down, achieving a denial-of-service.

Impact

The primary impact is a crash of the FreeSWITCH process, leading to a denial-of-service. Active calls are dropped. Because the overflow writes via %02x formatting, the control over the execution flow is limited to ASCII hex digits, making this primarily a DoS rather than a remote code execution (RCE) vector.

Recommendation

1. Inventory all FreeSWITCH instances and verify the status of mod_rtmp. Disable the module if it is not strictly required.
2. Upgrade all instances running versions older than 1.11.2 to the latest patched version.
3. Implement network-level access control lists (ACLs) to restrict access to port 1935 to trusted sources only.
4. Deploy the suggested hunt leads to detect reconnaissance and exploitation attempts against RTMP services.