{"vuid":"VU#772447","idnumber":"772447","name":"ffmpeg and Libav cross-domain information disclosure vulnerability","keywords":["ffmpeg","information exposure","m3u","video","avconv","concat","subfile"],"overview":"ffmpeg is a \"cross-platform solution to record, convert and stream audio and video\". ffmpeg is vulnerable to local file disclosure due to improper enforcement of domain restrictions when processing playlist files.","clean_desc":"CWE-201: Information Exposure Through Sent Data - CVE-2016-1897, CVE-2016-1898 When a user opens a maliciously crafted playlist file in ffmpeg, ffmpeg will query a server for remote data. By carefully crafting the playlist, an attacker can cause ffmpeg to request internet URIs that expose file:// content from the victim's machine. CVE-2016-1897 refers to an issue with processing playlists that use concatenations, while CVE-2016-1898 refers to a related issue with subfiles. According to a mailing list post from MITRE's CVE team: The essential problem is that a crafted file forces the victim to visit an arbitrary external URL, but this URL is constructed using data from the victim's local filesystem. More details are provided by the researcher in a blog post (in Russian). Libav is a fork of ffmpeg and is also vulnerable.","impact":"By causing a specially-crafted playlist file to be processed with ffmpeg or Libav, a remote attacker may acquire file contents from a vulnerable system. In some circumstances, this may occur without explicit user interaction (such as the creation of a thumbnail preview by a file manager).","resolution":"Apply an update ffmpeg version 2.8.5 has been released to address this issue. Affected users are encouraged to update as soon as possible.","workarounds":"","sysaffected":"","thanks":"This vulnerability was publicly disclosed by Maxim Andreev.","author":"This document was written by Garret Wassermann and Will Dormann.","public":["http://habrahabr.ru/company/mailru/blog/274855","http://www.openwall.com/lists/oss-security/2016/01/14/1"],"cveids":["CVE-2016-1897","CVE-2016-1898"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2016-01-15T19:21:32Z","publicdate":"2016-01-12T00:00:00Z","datefirstpublished":"2016-01-20T17:31:34Z","dateupdated":"2016-03-10T22:02:44Z","revision":49,"vrda_d1_directreport":"0","vrda_d1_population":"3","vrda_d1_impact":"3","cam_widelyknown":"0","cam_exploitation":"0","cam_internetinfrastructure":"0","cam_population":"0","cam_impact":"0","cam_easeofexploitation":"0","cam_attackeraccessrequired":"0","cam_scorecurrent":"0","cam_scorecurrentwidelyknown":"0","cam_scorecurrentwidelyknownexploited":"0","ipprotocol":"","cvss_accessvector":"N","cvss_accesscomplexity":"L","cvss_authentication":null,"cvss_confidentialityimpact":"P","cvss_integrityimpact":"N","cvss_availabilityimpact":"N","cvss_exploitablity":null,"cvss_remediationlevel":"OF","cvss_reportconfidence":"C","cvss_collateraldamagepotential":"ND","cvss_targetdistribution":"M","cvss_securityrequirementscr":"ND","cvss_securityrequirementsir":"ND","cvss_securityrequirementsar":"ND","cvss_basescore":"5","cvss_basevector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","cvss_temporalscore":"3.9","cvss_environmentalscore":"2.91185042022","cvss_environmentalvector":"CDP:ND/TD:M/CR:ND/IR:ND/AR:ND","metric":0.0,"vulnote":null}