5 ms·
Tell HN: Ffmpeg vulnerability allows attacker to get files from server or PC
ffmpeg vulnerability allows reading local files and sending them over network using a specially crafted video file. This affects not only file conversion (including thumbnail generation), but also any other operations that involve ffmpeg processing your file — for example, ffprobe is affected.
This is not remote code execution, the vulnerability is limited to reading local files and sending them over network, but that is already bad enough.
For example, a specially crafted «video» file uploaded to your server by an attacker could read your website config/private keys/etc and send that to the attacker once you try to generate a thumbnail for it or just probe it with ffmpeg.
On a PC, you don't even need to open a file to get affected, just downloading it would be enough in some cases — video files are processed with ffmpeg for filemanager thumbnails (i.e. KDE Dolphin), for search indexers, etc.
That vulnerability is public, has code samples to reproduce and build a malicious file, and is not fixed atm.
The recommended quick fix is to rebuild ffmpeg without network support (--disable-network configure flag).
Original post: http://habrahabr.ru/company/mailru/blog/274855/
The original text is in Russian, use https://translate.yandex.com or https://translate.google.com/ to read it.
- joeyspn 11y agoPC... and also mac? I have ffmpeg installed via homebrew...
- ChALkeR 11y agoIt's «PC» as in «server»/«PC», not as in «mac»/«PC».
- tsukikage 11y agoThe key insight is that you can construct an HTTP live streaming playlist that causes the player to pull lines from a series of files, concatenate them together to form a URL then visit that URL, making it possible to exfiltrate data. It is unclear whether this is ffmpeg-specific, or something the HTTP live streaming protocol actually requires and therefore potentially of wider impact; I can't find any obvious reference to this feature with either a quick Google or a skim of the Apple RFC. Does anyone know?
- ChALkeR 11y agoHm. Why did this end up in [ask]? Perhaps I made a mistake when posting this =).
- brudgers 11y agoIf there is text in the text box, it goes to "Ask HN" (or "Show HN" when that's in the title). To post a link, there should just be a title and a link and no comment.
- ChALkeR 11y agoShould I post this again with a link so it ends up in the news or not?
- maaarghk 11y agoShip's sailed I think, this is on frontpage, maybe dang will merge them at some point.
- ChALkeR 11y agoRe-posted as https://news.ycombinator.com/item?id=10895872 https://news.ycombinator.com/item?id=10895872
- abrezas 11y agoPatch on chrome that enabled ffmpeg networking https://codereview.chromium.org/1391383002/patch/1/10001 https://codereview.chromium.org/1391383002/patch/1/10001
- brudgers 11y agoLink: http://habrahabr.ru/company/mailru/blog/274855/ http://habrahabr.ru/company/mailru/blog/274855/
- ChALkeR 11y agohttps://translate.google.com/translate?sl=ru&tl=en&u=http%3A%2F%2Fhabrahabr.ru%2Fcompany%2Fmailru%2Fblog%2F274855%2F https://translate.google.com/translate?sl=ru&tl=en&u=http%3A... will work better, I suppose.
- anonfunction 11y agoCan the malicious video file be an actual mp4 file? We're accepting video and running it through ffmpeg, however we first verify the file is an mp4 using https://golang.org/src/net/http/sniff.go https://golang.org/src/net/http/sniff.go
- ChALkeR 11y agoBut that code that you linked to does not verify that the file is mp4, moreover, mp4Sig call is commented out.
- anonfunction 11y agoIt verifies that the beginning of a file is mp4 format. I'm actually running go 1.6 which does have the mp4 sniffing enabled.
- IceyEC 11y agoI was under the impression than MP4 could have all of its format specific headers at the end of the file just as well as the beginning according to the spec.
- anonfunction 11y agoThat is correct, however the beginning of the file does have a signature: https://mimesniff.spec.whatwg.org/#signature-for-mp4 https://mimesniff.spec.whatwg.org/#signature-for-mp4
- ryanlol 11y agoPossibly? Who knows? Parsers are complex and I doubt ffmpeg relies on file extensions to figure out the format.
- ChALkeR 11y agoIt does not, that's covered in the original article.
- ChALkeR 11y agoBy the way, mplayer is also affected, even after installing a fixed version of ffmpeg.
- ChALkeR 11y agoLooks like it bundles libavformat internally.
- dzbarsky 11y agoThis is why you should use containers for running binaries on user-supplied data.
- josesilva 11y agoAny CVE or answer from upstream about it? Is Firefox as well affected?
- espes 11y agoHeh, this 'feature' was the intended solution of a CTF challenge 3 months ago: https://github.com/ctfs/write-ups-2015/tree/master/9447-ctf-2015/web/super-turbo-atomic-gif-converter https://github.com/ctfs/write-ups-2015/tree/master/9447-ctf-...