3 ms·

I checked with Ubuntu's ffmpeg and it is enabled by default. There are a huge list of codecs enabled by default (maybe all of them?). Given the security track r

I checked with Ubuntu's ffmpeg and it is enabled by default. There are a huge list of codecs enabled by default (maybe all of them?). Given the security track record of codecs implemented in C, this means it's basically guaranteed that there are dozens of security vulnerabilities in ffmpeg. I think the same is probably true for VLC to a lesser extent, which is pretty wild considering I've never heard of it being used as an attack vector, e.g. via torrents.

haskellshill 1y ago
VLC is pretty popular on windows, but ffmpeg? Is there any commonly used windows app that relies on it? I doubt it'd be worth one's time to write exploits for desktop linux
- michaelt 1y ago
  Depends if any important websites are re-compressing user-uploaded videos. If there's a website converting user-uploaded gifs to mp4 to save on bandwidth or something, I wouldn't be surprised if they used ffmpeg to do it.
- dpe82 1y ago
  VLC and ffmpeg share the same underlying library family (libav*) where this vulnerability lives. > I doubt it'd be worth one's time to write exploits for desktop Linux How many developers, network administrators, etc. run desktop Linux? Gaining access to those can be very, very valuable.
  - brigade 1y ago
    FFmpeg based players have been popular for 20 years now. Has there been a single documented actual use of their libraries as the exploitation vector anytime in the last two decades?
    - dpe82 1y ago
      I'm certain it's happened but since I don't have one off the top of my head I'll instead point out a related issue: https://en.wikipedia.org/wiki/Stagefright_(bug) https://en.wikipedia.org/wiki/Stagefright_(bug) It's worth pointing out that many, many, many things use the libav* library family.
      - brigade 1y ago
        Yes, I know that multimedia/image vulnerabilities are popular vectors for zero-click attacks. My point is that desktop players are not a vector for zero-click attacks, and ffmpeg has not generally been used in end-user situations that are targets of zero-click or drive-by attacks. Mostly because of the license, but still. If the exploit chain involves the user downloading and opening a file, something like >99% of the time the next step already involves executable code (or Office macros), which makes any ffmpeg vuln completely useless.
        dpe82 1y ago
        Chrome uses ffmpeg's underlying libraries. It's used way, way more than you think.
        brigade 1y ago
        Yes, I’m quite familiar with that. Chrome is why I added the “generally” qualifier. And to the best of my knowledge, there has not been any in-the-wild exploit against Chrome through the handful of ffmpeg codecs they enable. Not even pwn2own type competitions either, as I recall.
        dpe82 1y ago
        I guess I'm confused - are you trying to imply the lack of a thorough, publicly reported successful exploit (or us just not casually giving you one that you care about) means that we're all released from the responsibility of taking potential exploits seriously?
- godelski 1y ago
  > VLC is pretty popular on windows, but ffmpeg? I'm pretty confident VLC uses libavcodec > Is there any commonly used windows app that relies on it? A lot of stuff uses libavcodec
  - deleted 1y ago
    [deleted]
- heavyset_go 1y ago
  ffmpeg is deployed everywhere, and old versions of ffmpeg are baked into a lot of devices. If you have a device that does image, audio or video, libav and/or ffmpeg is likely somewhere in the stack. Your TV, camera, console or streaming device might use the software. If you're using SaaS that does image, audio or video, they are likely using ffmpeg related software somewhere in their stack. Same thing with apps, Android and iOS apps might use the libraries, as well as desktop apps.
- Sophira 1y ago
  Yes, lots. To name an example, yt-dip uses it on all platforms, including Windows, which means that any video downloader front-end that uses it also uses FFmpeg.
  - Sophira 1y ago
    ...I mean "yt-dlp", of course. Phone autocorrected >_<
ls612 1y ago
I think that the x264 and hevc codecs are much more battle tested and a 0day for them would be worth enough that nobody would bother using it on random torrenters.
- IshKebab 1y ago
  But you don't need to use a popular codec, because all codecs are enabled by default.
  - ls612 1y ago
    Yeah but most public trackers will give lots of side eye to torrents that contain an mkv that isn’t in one of those two formats.
    - IshKebab 1y ago
      Really? You think trackers download files and analyse their contents before listing them? I don't.
      - ls612 1y ago
        TPB? No. But 1337 and rutracker definitely do basic quality control. Nothing like a private tracker but they take down things like .mkv.lnk and similar.
        ValdikSS 1y ago
        You can report viruses on TPB's forum, there's usually entire accounts which upload viruses which are easy to find.
hulitu 1y ago
> Given the security track record of codecs implemented in C, this means it's basically guaranteed that there are dozens of security vulnerabilities in ffmpeg. Or in, you know, external libraries. Maybe ffmeg shall be run with sanitized input (and not from a "web page" ) ? Just saying

haskellshill 1y ago

VLC is pretty popular on windows, but ffmpeg? Is there any commonly used windows app that relies on it? I doubt it'd be worth one's time to write exploits for desktop linux

michaelt 1y ago
Depends if any important websites are re-compressing user-uploaded videos. If there's a website converting user-uploaded gifs to mp4 to save on bandwidth or something, I wouldn't be surprised if they used ffmpeg to do it.
dpe82 1y ago
VLC and ffmpeg share the same underlying library family (libav*) where this vulnerability lives. > I doubt it'd be worth one's time to write exploits for desktop Linux How many developers, network administrators, etc. run desktop Linux? Gaining access to those can be very, very valuable.
- brigade 1y ago
  FFmpeg based players have been popular for 20 years now. Has there been a single documented actual use of their libraries as the exploitation vector anytime in the last two decades?
  - dpe82 1y ago
    I'm certain it's happened but since I don't have one off the top of my head I'll instead point out a related issue: https://en.wikipedia.org/wiki/Stagefright_(bug) https://en.wikipedia.org/wiki/Stagefright_(bug) It's worth pointing out that many, many, many things use the libav* library family.
    - brigade 1y ago
      Yes, I know that multimedia/image vulnerabilities are popular vectors for zero-click attacks. My point is that desktop players are not a vector for zero-click attacks, and ffmpeg has not generally been used in end-user situations that are targets of zero-click or drive-by attacks. Mostly because of the license, but still. If the exploit chain involves the user downloading and opening a file, something like >99% of the time the next step already involves executable code (or Office macros), which makes any ffmpeg vuln completely useless.
      - dpe82 1y ago
        Chrome uses ffmpeg's underlying libraries. It's used way, way more than you think.
        brigade 1y ago
        Yes, I’m quite familiar with that. Chrome is why I added the “generally” qualifier. And to the best of my knowledge, there has not been any in-the-wild exploit against Chrome through the handful of ffmpeg codecs they enable. Not even pwn2own type competitions either, as I recall.
        dpe82 1y ago
        I guess I'm confused - are you trying to imply the lack of a thorough, publicly reported successful exploit (or us just not casually giving you one that you care about) means that we're all released from the responsibility of taking potential exploits seriously?
godelski 1y ago
> VLC is pretty popular on windows, but ffmpeg? I'm pretty confident VLC uses libavcodec > Is there any commonly used windows app that relies on it? A lot of stuff uses libavcodec
- deleted 1y ago
  [deleted]
heavyset_go 1y ago
ffmpeg is deployed everywhere, and old versions of ffmpeg are baked into a lot of devices. If you have a device that does image, audio or video, libav and/or ffmpeg is likely somewhere in the stack. Your TV, camera, console or streaming device might use the software. If you're using SaaS that does image, audio or video, they are likely using ffmpeg related software somewhere in their stack. Same thing with apps, Android and iOS apps might use the libraries, as well as desktop apps.
Sophira 1y ago
Yes, lots. To name an example, yt-dip uses it on all platforms, including Windows, which means that any video downloader front-end that uses it also uses FFmpeg.
- Sophira 1y ago
  ...I mean "yt-dlp", of course. Phone autocorrected >_<

ls612 1y ago

I think that the x264 and hevc codecs are much more battle tested and a 0day for them would be worth enough that nobody would bother using it on random torrenters.

IshKebab 1y ago
But you don't need to use a popular codec, because all codecs are enabled by default.
- ls612 1y ago
  Yeah but most public trackers will give lots of side eye to torrents that contain an mkv that isn’t in one of those two formats.
  - IshKebab 1y ago
    Really? You think trackers download files and analyse their contents before listing them? I don't.
    - ls612 1y ago
      TPB? No. But 1337 and rutracker definitely do basic quality control. Nothing like a private tracker but they take down things like .mkv.lnk and similar.
      - ValdikSS 1y ago
        You can report viruses on TPB's forum, there's usually entire accounts which upload viruses which are easy to find.

hulitu 1y ago

> Given the security track record of codecs implemented in C, this means it's basically guaranteed that there are dozens of security vulnerabilities in ffmpeg. Or in, you know, external libraries. Maybe ffmeg shall be run with sanitized input (and not from a "web page" ) ? Just saying