#2010-004 FFmpeg/libavcodec arbitrary offset dereference Description: The libavcodec library, an open source video encoding/decoding library part of the FFmpeg project, suffers from an arbitrary offset dereference vulnerability. The vulnerability affects the flic file format parser, insufficient restrictions on a writable buffer can be exploited to execute arbitrary code via the heap memory. A specific flic file can be crafted to trigger the vulnerability. The MPlayer multimedia player is also affected as it statically includes libavcodec, the flic codec can be disabled in codecs.conf configuration file in order to workaround the issue. Affected version: libavcodec <= 0.6 MPlayer <= 1.0_rc3, snapshot 2010-09-27 Fixed version: libavcodec >= r25223 (see References) MPlayer >= snapshot 2010-09-28 Credit: vulnerability report and PoC code received from Cesar Bernardini <cesar [dot] bernardini [at] gmail [dot] com> and Felipe Felipe Andres Manzano <felipe [dot] andres [dot] manzano [at] gmail [dot] com>. CVE: CVE-2010-3429 Timeline: 2010-08-24: vulnerability report received 2010-08-25: contacted mplayer maintainers 2010-08-27: mplayer security team confirms report, describes mplayer workaround and points to ffmpeg as the originally affected package 2010-08-27: contacted ffmpeg maintainer 2010-08-27: preliminary patch is provided by ffmpeg maintainer 2010-08-28: reporter approves patch 2010-09-13: upstream confirms patch, two weeks embargo is proposed 2010-09-13: embargo accepted, contacted affected vendors 2010-09-27: patch committed to ffmpeg repository 2010-09-28: patch automatically pulled to mplayer repository from ffmpeg one 2010-09-28: oCERT advisory published References: http://git.ffmpeg.org/?p=ffmpeg;a=commitdiff;h=16c592155f117ccd7b86006c4 5aacc692a81c23b Permalink: http://www.ocert.org/advisories/ocert-2010-004.html -- Andrea Barisani | Founder & Project Coordinator oCERT | Open Source Computer Emergency Response Team <lcars (at) ocert (dot) org [email concealed]> http://www.ocert.org 0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E "Pluralitas non est ponenda sine necessitate"