Critical Vulnerability in FFmpeg: Improper Restriction of HTTP Live Streaming Filename Extensions
Summary
ALPINE-CVE-2017-9993: FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrar... Affects ffmpeg versions < 3.1.9-r0. Fixed in 3.1.9-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a widely-used open-source multimedia framework that enables users to record, convert, and stream audio and video. It supports various formats and codecs, making it a versatile tool for developers and content creators. However, certain versions of FFmpeg are vulnerable to a security issue that allows unauthorized access to files through manipulated playlist data.
Vulnerability Detail
The vulnerability, identified as CVE-2017-9993, affects FFmpeg versions prior to 2.8.12, 3.0.x, 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2. It stems from improper restrictions on HTTP Live Streaming filename extensions and demuxer names. This flaw enables attackers to craft malicious playlist data that can lead to unauthorized reading of arbitrary files on the server, posing significant risks to data confidentiality.
How To Fix
Minimum fixed version
3.1.9-r0
This is the first release that contains the fix.
sudo apk add --upgrade ffmpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider restricting access to the server's file system to prevent unauthorized file reading. Additionally, validate and sanitize playlist data before processing to mitigate risks.
Conclusion
The vulnerability in FFmpeg poses a significant risk to data confidentiality due to improper restrictions on file access. It is crucial for users to update to the latest patched versions to mitigate these risks effectively. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for ffmpeg →
FAQ
CVE-2017-9993 is a vulnerability in FFmpeg that allows attackers to read arbitrary files through crafted playlist data.
Affected versions include FFmpeg before 2.8.12, 3.0.x, 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2.
Attackers can exploit this vulnerability to access sensitive files on the server, leading to data breaches.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The CVSS score for CVE-2017-9993 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ffmpeg.
