This is why you should use containers for running binaries on user-supplied data.
Tell HN: Ffmpeg vulnerability allows attacker to get files from server or PC
21–25 of 25 posts
Re: Tell HN: Ffmpeg vulnerability allows attacker to get files from server or PC
#22Earlier quoted context omitted.
But that code that you linked to does not verify that the file is mp4, moreover, mp4Sig call is commented out.
It verifies that the beginning of a file is mp4 format. I'm actually running go 1.6 which does have the mp4 sniffing enabled.
I was under the impression than MP4 could have all of its format specific headers at the end of the file just as well as the beginning according to the spec.
Re: Tell HN: Ffmpeg vulnerability allows attacker to get files from server or PC
#23Any CVE or answer from upstream about it? Is Firefox as well affected?
Re: Tell HN: Ffmpeg vulnerability allows attacker to get files from server or PC
#24Heh, this 'feature' was the intended solution of a CTF challenge 3 months ago: https://github.com/ctfs/write-ups-2015/tree/master/9447-ctf-...
Re: Tell HN: Ffmpeg vulnerability allows attacker to get files from server or PC
#25Earlier quoted context omitted.
It verifies that the beginning of a file is mp4 format. I'm actually running go 1.6 which does have the mp4 sniffing enabled.
I was under the impression than MP4 could have all of its format specific headers at the end of the file just as well as the beginning according to the spec.
That is correct, however the beginning of the file does have a signature: https://mimesniff.spec.whatwg.org/#signature-for-mp4