search menu icon-carat-right cmu-wordmark

CERT Coordination Center

ffmpeg and Libav cross-domain information disclosure vulnerability

Vulnerability Note VU#772447

Original Release Date: 2016-01-20 | Last Revised: 2016-03-10

Overview

ffmpeg is a "cross-platform solution to record, convert and stream audio and video". ffmpeg is vulnerable to local file disclosure due to improper enforcement of domain restrictions when processing playlist files.

Description

CWE-201: Information Exposure Through Sent Data - CVE-2016-1897, CVE-2016-1898

When a user opens a maliciously crafted playlist file in ffmpeg, ffmpeg will query a server for remote data. By carefully crafting the playlist, an attacker can cause ffmpeg to request internet URIs that expose file:// content from the victim's machine. CVE-2016-1897 refers to an issue with processing playlists that use concatenations, while CVE-2016-1898 refers to a related issue with subfiles.

According to a mailing list post from MITRE's CVE team:

The essential problem is that a crafted file forces the victim to visit an arbitrary external URL, but this URL is constructed using data from the victim's local filesystem.

More details are provided by the researcher in a blog post (in Russian).

Libav is a fork of ffmpeg and is also vulnerable.

Impact

By causing a specially-crafted playlist file to be processed with ffmpeg or Libav, a remote attacker may acquire file contents from a vulnerable system. In some circumstances, this may occur without explicit user interaction (such as the creation of a thumbnail preview by a file manager).

Solution

Apply an update

ffmpeg version 2.8.5 has been released to address this issue. Affected users are encouraged to update as soon as possible.

Vendor Information

772447
 
Affected   Unknown   Unaffected

Alpine Linux

Updated:  January 20, 2016

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://bugs.alpinelinux.org/issues/5029

Arch Linux

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

https://bugs.archlinux.org/task/47738 https://lists.archlinux.org/pipermail/arch-security/2016-January/000522.html

Debian GNU/Linux

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

https://security-tracker.debian.org/tracker/CVE-2016-1897

Gentoo Linux

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Libav

Updated:  January 20, 2016

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

SUSE Linux

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

https://www.suse.com/security/cve/CVE-2016-1897.html https://bugzilla.suse.com/show_bug.cgi?id=961937

Ubuntu

Notified:  January 20, 2016 Updated:  January 20, 2016

Statement Date:   January 20, 2016

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We've sponsored updates for Ubuntu 15.04 (ffmpeg 7:2.5.10-0ubuntu0.15.04.1) and Ubuntu 15.10 (ffmpeg 7:2.7.5-0ubuntu0.15.10.1).

Vendor References

https://bugs.launchpad.net/ubuntu/+source/ffmpeg/+bug/1533367

VideoLAN

Updated:  January 21, 2016

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://git.videolan.org/gitweb.cgi/ffmpeg.git/?p=ffmpeg.git;a=commitdiff;h=7145e80b4f78cff5ed5fee04d4c4d53daaa0e077 http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6ba42b6482c725a59eb468391544dc0c75b8c6f0

ffmpeg

Updated:  January 20, 2016

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

https://www.ffmpeg.org/security.html

CentOS

Notified:  January 20, 2016 Updated:  January 21, 2016

Statement Date:   January 21, 2016

Status

  Not Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

Red Hat ships only qffmpeg, which is a stripped-down fork of ffmpeg that is not vulnerable.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Microsoft Corporation

Notified:  January 20, 2016 Updated:  March 10, 2016

Statement Date:   March 10, 2016

Status

  Not Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

OmniTI

Notified:  January 20, 2016 Updated:  January 20, 2016

Statement Date:   January 20, 2016

Status

  Not Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

Neither of these (ffmpeg or libav) are in OmniOS. They may be in unsupported 3rd-party packages, but they are not in OmniOS itself.

Red Hat, Inc.

Notified:  January 20, 2016 Updated:  January 21, 2016

Statement Date:   January 21, 2016

Status

  Not Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

Red Hat ships only qffmpeg, which is a stripped-down fork of ffmpeg that is not vulnerable.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Apple

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

CoreOS

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

DesktopBSD

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

DragonFly BSD Project

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

EMC Corporation

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

F5 Networks, Inc.

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Fedora Project

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

FreeBSD Project

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Hardened BSD

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Hewlett Packard Enterprise

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Hitachi

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

IBM Corporation

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

IBM eServer

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Juniper Networks

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

NEC Corporation

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

NetBSD

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Nokia

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Openwall GNU/*/Linux

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Oracle Corporation

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

PC-BSD

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

QNX Software Systems Inc.

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Slackware Linux Inc.

Notified:  January 20, 2016 Updated:  January 21, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Sony Corporation

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Turbolinux

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Unisys

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

m0n0wall

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

openSUSE project

Notified:  January 20, 2016 Updated:  January 20, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.


CVSS Metrics

Group Score Vector
Base 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N
Temporal 3.9 E:POC/RL:OF/RC:C
Environmental 2.9 CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

Credit

This vulnerability was publicly disclosed by Maxim Andreev.

This document was written by Garret Wassermann and Will Dormann.

Other Information

CVE IDs: CVE-2016-1897, CVE-2016-1898
Date Public: 2016-01-12
Date First Published: 2016-01-20
Date Last Updated: 2016-03-10 22:02 UTC
Document Revision: 47

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.