Can the malicious video file be an actual mp4 file? We're accepting video and running it through ffmpeg, however we first verify the file is an mp4 using https://golang.org/src/net/http/sniff.go
Tell HN: Ffmpeg vulnerability allows attacker to get files from server or PC
11–20 of 25 posts
Re: Tell HN: Ffmpeg vulnerability allows attacker to get files from server or PC
#12Can the malicious video file be an actual mp4 file? We're accepting video and running it through ffmpeg, however we first verify the file is an mp4 using https://golang.org/src/net/http/sniff.go
But that code that you linked to does not verify that the file is mp4, moreover, mp4Sig call is commented out.
Re: Tell HN: Ffmpeg vulnerability allows attacker to get files from server or PC
#13Earlier quoted context omitted.
If there is text in the text box, it goes to "Ask HN" (or "Show HN" when that's in the title). To post a link, there should just be a title and a link and no comment.
Should I post this again with a link so it ends up in the news or not?
Ship's sailed I think, this is on frontpage, maybe dang will merge them at some point.
Re: Tell HN: Ffmpeg vulnerability allows attacker to get files from server or PC
#14Can the malicious video file be an actual mp4 file? We're accepting video and running it through ffmpeg, however we first verify the file is an mp4 using https://golang.org/src/net/http/sniff.go
Possibly? Who knows? Parsers are complex and I doubt ffmpeg relies on file extensions to figure out the format.
Re: Tell HN: Ffmpeg vulnerability allows attacker to get files from server or PC
#15Can the malicious video file be an actual mp4 file? We're accepting video and running it through ffmpeg, however we first verify the file is an mp4 using https://golang.org/src/net/http/sniff.go
Possibly? Who knows? Parsers are complex and I doubt ffmpeg relies on file extensions to figure out the format.
It does not, that's covered in the original article.
Re: Tell HN: Ffmpeg vulnerability allows attacker to get files from server or PC
#16Patch on chrome that enabled ffmpeg networking https://codereview.chromium.org/1391383002/patch/1/10001
Re: Tell HN: Ffmpeg vulnerability allows attacker to get files from server or PC
#17Can the malicious video file be an actual mp4 file? We're accepting video and running it through ffmpeg, however we first verify the file is an mp4 using https://golang.org/src/net/http/sniff.go
But that code that you linked to does not verify that the file is mp4, moreover, mp4Sig call is commented out.
It verifies that the beginning of a file is mp4 format. I'm actually running go 1.6 which does have the mp4 sniffing enabled.
Re: Tell HN: Ffmpeg vulnerability allows attacker to get files from server or PC
#18Earlier quoted context omitted.
Possibly? Who knows? Parsers are complex and I doubt ffmpeg relies on file extensions to figure out the format.
It does not, that's covered in the original article.
It does not what? Can you share quotes from the article or the translated article source you read?
Confusion:
Are you saying that ffmpeg doesn't detect file by extension?
or
Are you saying that ffmpeg won't execute the malicious code if it's found appended to a valid video?
Re: Tell HN: Ffmpeg vulnerability allows attacker to get files from server or PC
#19By the way, mplayer is also affected, even after installing a fixed version of ffmpeg.
Re: Tell HN: Ffmpeg vulnerability allows attacker to get files from server or PC
#20By the way, mplayer is also affected, even after installing a fixed version of ffmpeg.
Looks like it bundles libavformat internally.