bugtraq - [oCERT-2010-004] FFmpeg/libavcodec arbitrary offset dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20100928134746.GR8591@core.inversepath.com>
Date: Tue, 28 Sep 2010 15:47:46 +0200
From: Andrea Barisani <lcars@...rt.org>
To: oss-security@...ts.openwall.com, ocert-announce@...ts.ocert.org,
	bugtraq@...urityfocus.com
Subject: [oCERT-2010-004] FFmpeg/libavcodec arbitrary offset dereference

#2010-004 FFmpeg/libavcodec arbitrary offset dereference

Description:

The libavcodec library, an open source video encoding/decoding library part of
the FFmpeg project, suffers from an arbitrary offset dereference vulnerability.

The vulnerability affects the flic file format parser, insufficient
restrictions on a writable buffer can be exploited to execute arbitrary code
via the heap memory. A specific flic file can be crafted to trigger the
vulnerability.

The MPlayer multimedia player is also affected as it statically includes
libavcodec, the flic codec can be disabled in codecs.conf configuration file in
order to workaround the issue.

Affected version:

libavcodec <= 0.6

MPlayer <= 1.0_rc3, snapshot 2010-09-27

Fixed version:

libavcodec >= r25223 (see References)

MPlayer >= snapshot 2010-09-28

Credit: vulnerability report and PoC code received from Cesar Bernardini <cesar
[dot] bernardini [at] gmail [dot] com> and Felipe Felipe Andres Manzano <felipe
[dot] andres [dot] manzano [at] gmail [dot] com>.

CVE: CVE-2010-3429

Timeline:

2010-08-24: vulnerability report received
2010-08-25: contacted mplayer maintainers
2010-08-27: mplayer security team confirms report, describes mplayer
            workaround and points to ffmpeg as the originally affected package
2010-08-27: contacted ffmpeg maintainer
2010-08-27: preliminary patch is provided by ffmpeg maintainer
2010-08-28: reporter approves patch
2010-09-13: upstream confirms patch, two weeks embargo is proposed
2010-09-13: embargo accepted, contacted affected vendors
2010-09-27: patch committed to ffmpeg repository
2010-09-28: patch automatically pulled to mplayer repository from ffmpeg one
2010-09-28: oCERT advisory published

References:
http://git.ffmpeg.org/?p=ffmpeg;a=commitdiff;h=16c592155f117ccd7b86006c45aacc692a81c23b

Permalink:
http://www.ocert.org/advisories/ocert-2010-004.html

-- 
Andrea Barisani |                Founder & Project Coordinator
          oCERT | Open Source Computer Emergency Response Team

<lcars@...rt.org>                         http://www.ocert.org
 0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E
        "Pluralitas non est ponenda sine necessitate"