Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Ffmpeg vulnerability allows attacker to get files from server or PC

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 25 posts

Tell HN: Ffmpeg vulnerability allows attacker to get files from server or PC

#1

Post by ChALkeR »

ffmpeg vulnerability allows reading local files and sending them over network using a specially crafted video file. This affects not only file conversion (including thumbnail generation), but also any other operations that involve ffmpeg processing your file — for example, ffprobe is affected.

This is not remote code execution, the vulnerability is limited to reading local files and sending them over network, but that is already bad enough.

For example, a specially crafted «video» file uploaded to your server by an attacker could read your website config/private keys/etc and send that to the attacker once you try to generate a thumbnail for it or just probe it with ffmpeg.

On a PC, you don't even need to open a file to get affected, just downloading it would be enough in some cases — video files are processed with ffmpeg for filemanager thumbnails (i.e. KDE Dolphin), for search indexers, etc.

That vulnerability is public, has code samples to reproduce and build a malicious file, and is not fixed atm.

The recommended quick fix is to rebuild ffmpeg without network support (--disable-network configure flag).

Original post: http://habrahabr.ru/company/mailru/blog/274855/

The original text is in Russian, use https://translate.yandex.com or https://translate.google.com/ to read it.

Re: Tell HN: Ffmpeg vulnerability allows attacker to get files from server or PC

#4

Post by tsukikage »

The key insight is that you can construct an HTTP live streaming playlist that causes the player to pull lines from a series of files, concatenate them together to form a URL then visit that URL, making it possible to exfiltrate data.

It is unclear whether this is ffmpeg-specific, or something the HTTP live streaming protocol actually requires and therefore potentially of wider impact; I can't find any obvious reference to this feature with either a quick Google or a skim of the Apple RFC. Does anyone know?

Re: Tell HN: Ffmpeg vulnerability allows attacker to get files from server or PC

#6

Post by brudgers »

ChALkeR wrote: post #5

Hm. Why did this end up in [ask]? Perhaps I made a mistake when posting this =).

If there is text in the text box, it goes to "Ask HN" (or "Show HN" when that's in the title).

To post a link, there should just be a title and a link and no comment.

Re: Tell HN: Ffmpeg vulnerability allows attacker to get files from server or PC

#8

Post by ChALkeR »

brudgers wrote: post #6
ChALkeR wrote: post #5

Hm. Why did this end up in [ask]? Perhaps I made a mistake when posting this =).

If there is text in the text box, it goes to "Ask HN" (or "Show HN" when that's in the title). To post a link, there should just be a title and a link and no comment.

Should I post this again with a link so it ends up in the news or not?

Re: Tell HN: Ffmpeg vulnerability allows attacker to get files from server or PC

#10

Post by ChALkeR »

brudgers wrote: post #6
ChALkeR wrote: post #5

Hm. Why did this end up in [ask]? Perhaps I made a mistake when posting this =).

If there is text in the text box, it goes to "Ask HN" (or "Show HN" when that's in the title). To post a link, there should just be a title and a link and no comment.

Re-posted as https://news.ycombinator.com/item?id=10895872
Post reply on HN