DoS Vulnerability in FFmpeg
Summary
CVE-2017-14223: In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. Affects ffmpeg across 3 version ranges.
< 3.1.11-r0
< 9079c70d2095643af6954001d0627445650b85a6
< afc9c683ed9db01edb357bc8c19edad4282b3a97
Fixed in 3.1.11-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
FFmpeg is a popular open-source multimedia framework used for handling audio, video, and other media files. It provides a set of libraries and tools for encoding, decoding, and streaming media content. This vulnerability affects the FFmpeg package in the Alpine Linux distribution versions 3.4, 3.5, 3.6, and 3.7.
Vulnerability Detail
The vulnerability, identified as CVE-2017-14223, exists in the asfdec_f.c file of the libavformat component in FFmpeg version 3.3.3. It is a Denial-of-Service (DoS) vulnerability caused by a lack of an EOF (End of File) check in the asf_build_simple_index() function. When a specially crafted ASF file is provided, the function enters a loop that consumes significant CPU and memory resources, leading to a DoS condition. The vulnerability can be triggered by an attacker by providing an ASF file with a large 'ict' field in the header but insufficient backing data.
How To Fix
Minimum fixed version
3.1.11-r0
This is the first release that contains the fix.
sudo apk add --upgrade ffmpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The DoS vulnerability in FFmpeg can be mitigated by updating the package to the fixed versions mentioned. It is important to promptly apply the necessary updates to ensure the security and stability of systems using FFmpeg. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ffmpeg →
FAQ
FFmpeg is an open-source multimedia framework used for handling audio, video, and other media files. It provides libraries and tools for encoding, decoding, and streaming media content.
This vulnerability can be exploited by an attacker to cause a DoS condition in FFmpeg, leading to high CPU consumption and memory usage. This can potentially impact the availability and performance of systems using FFmpeg.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities.
The recommended mitigation is to update the FFmpeg package to the fixed versions mentioned earlier. This ensures that the vulnerability is patched and the DoS condition is prevented.
You can find more information about this vulnerability, including technical details and the CVE identifier, in the CVE-2017-14223 JSON file available at the following source: https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-14223.json
Related vulnerabilities
Recent vulnerabilities recorded for ffmpeg.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
