Denial of Service Vulnerability in FFmpeg - CVE-2017-11665
Summary
ALPINE-CVE-2017-11665: The ff_amf_get_field_value function in libavformat/rtmppkt.c in FFmpeg 3.3.2 allows remote RTMP servers to cause a denial of service (Segmentation Violation and application crash) via a crafted stream. Affects ffmpeg versions < 3.1.10-r0. Fixed in 3.1.10-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a widely-used open-source software suite for handling multimedia data, including audio and video processing. It provides libraries and tools for encoding, decoding, transcoding, muxing, demuxing, streaming, filtering, and playing almost anything that humans and machines have created. This vulnerability affects specific versions of FFmpeg, which can be exploited by remote RTMP servers.
Vulnerability Detail
The vulnerability identified as CVE-2017-11665 is found in the ff_amf_get_field_value function within the libavformat/rtmppkt.c file of FFmpeg version 3.3.2. It allows remote RTMP servers to send crafted streams that can cause a segmentation violation, leading to application crashes. This vulnerability can result in a denial of service, impacting the availability of services relying on FFmpeg for multimedia processing.
How To Fix
Minimum fixed version
3.1.10-r0
This is the first release that contains the fix.
sudo apk add --upgrade ffmpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to the RTMP server to trusted sources only, thereby minimizing the risk of exploitation until the package can be updated.
Conclusion
CVE-2017-11665 is a significant vulnerability in FFmpeg that can lead to denial of service attacks. It is crucial for users to update their FFmpeg installations to the latest patched versions to ensure the security and stability of their multimedia applications.
See every vulnerability recorded for ffmpeg →
FAQ
CVE-2017-11665 is a vulnerability in FFmpeg that allows remote servers to cause a denial of service through crafted RTMP streams.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
The affected versions include FFmpeg 3.3.2 and earlier versions in Alpine Linux distributions v3.4, v3.5, and v3.6.
The CVSS score for CVE-2017-11665 is 7.5, indicating a high severity level.
If immediate updates are not possible, restrict access to your RTMP server to trusted sources to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for ffmpeg.
