FFmpeg 2.0 libavcodec/rpza.c rpza_decode_stream memory corruption

Summaryinfo

A vulnerability categorized as critical has been discovered in FFmpeg 2.0. This affects the function rpza_decode_stream in the library libavcodec/rpza.c. The manipulation results in memory corruption. Moreover, an exploit is present. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in FFmpeg 2.0 (Multimedia Processing Software). Affected is the function rpza_decode_stream in the library libavcodec/rpza.c. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, and integrity.

The issue has been introduced in 07/11/2013. The weakness was disclosed 08/22/2013 by Michael Niedermayer as avcodec/rpza: Perform pointer advance and checks before using the pointers as confirmed advisory (Website). The advisory is shared for download at git.videolan.org. The public release has been coordinated in cooperation with the vendor. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known.

It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 42 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 0.11.4 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.videolan.org. The best possible mitigation is suggested to be upgrading to the latest version. A possible mitigation has been published 6 days after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at OSVDB (97409†) and Secunia (SA54921†). Further details are available at git.videolan.org. The entries VDB-10447, VDB-10448 and VDB-10453 are pretty similar. Once again VulDB remains the best source for vulnerability data.

Affected

• FFmpeg 2.0
• Libav 9.8

Productinfo

Type

• Multimedia Processing Software

Name

• FFmpeg

Version

• 2.0

License

• open-source

Website

• Product: https://ffmpeg.org/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion