Critical DoS Vulnerability in FFmpeg Package - CVE-2017-14223
Summary
ALPINE-CVE-2017-14223: In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. Affects ffmpeg versions < 3.1.11-r0. Fixed in 3.1.11-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a widely-used open-source multimedia framework that allows users to record, convert, and stream audio and video. It supports numerous codecs and formats, making it a versatile tool for media processing. However, certain versions of FFmpeg are vulnerable to a denial-of-service (DoS) attack due to improper handling of specific file formats, particularly ASF files.
Vulnerability Detail
The vulnerability, identified as CVE-2017-14223, exists in the libavformat/asfdec_f.c file of FFmpeg version 3.3.3. It arises from a lack of an EOF (End of File) check in the asf_build_simple_index() function. When a specially crafted ASF file is processed, which claims a large 'ict' field in the header but lacks sufficient backing data, the for loop within the function can lead to excessive CPU and memory consumption, potentially crashing the application or causing it to become unresponsive.
How To Fix
Minimum fixed version
3.1.11-r0
This is the first release that contains the fix.
sudo apk add --upgrade ffmpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing untrusted ASF files or implement additional checks in their applications to validate the integrity of the files before processing them.
Conclusion
The CVE-2017-14223 vulnerability in FFmpeg poses a significant risk due to its potential to cause denial of service through malformed ASF files. Users are strongly advised to update to the latest patched versions to mitigate this risk and ensure the stability of their applications.
See every vulnerability recorded for ffmpeg →
FAQ
CVE-2017-14223 is a vulnerability in FFmpeg that can lead to denial of service due to excessive CPU and memory usage when processing malformed ASF files.
FFmpeg versions prior to 3.1.11-r0 for Alpine v3.4 and v3.5, 3.2.8-r0 for Alpine v3.6, and 3.3.4-r0 for Alpine v3.7 are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If exploited, this vulnerability can lead to denial of service, causing applications to consume excessive resources and potentially crash.
Yes, as a workaround, avoid processing untrusted ASF files and implement additional validation checks in your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for ffmpeg.
