PT-2010-5649 · FFmpeg+1 · Ffmpeg-Dbg+7

Will Dormann · Published 1970-01-01 · Updated 2011-10-26 · CVE-2009-4636

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FFmpeg version 0.5 libavcodec51 (affected versions not specified) libavcodec-dev (affected versions not specified) libavdevice52 (affected versions not specified) libavdevice-dev (affected versions not specified) ffmpeg-dbg (affected versions not specified) ffmpeg-doc (affected versions not specified)

Description The issue concerns multiple vulnerabilities in various packages of the Debian GNU/Linux operating system, including libavcodec51, libavcodec-dev, libavdevice52, libavdevice-dev, ffmpeg-dbg, and ffmpeg-doc. These vulnerabilities can be exploited remotely, potentially leading to a violation of confidentiality, integrity, and availability of protected information. Additionally, a specific vulnerability in FFmpeg 0.5 allows remote attackers to cause a denial of service by triggering an infinite loop with a crafted file.

Recommendations For FFmpeg version 0.5, update to a newer version to mitigate the risk of a denial of service. For libavcodec51, restrict access to sensitive information until a patch is available. For libavcodec-dev, avoid using vulnerable functions until a fix is applied. For libavdevice52, disable remote access to minimize the risk of exploitation. For libavdevice-dev, restrict the use of vulnerable modules until a patch is available. For ffmpeg-dbg, avoid using debug functions that may trigger vulnerabilities. For ffmpeg-doc, restrict access to documentation that may contain sensitive information. At the moment, there is no information about a newer version that contains a fix for this vulnerability in the other affected packages.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

CWE-189

Related Identifiers

BDU:2015-02202

BDU:2015-02203

BDU:2015-02205

BDU:2015-02206

BDU:2015-02207

BDU:2015-02208

CVE-2009-4636

DSA-2000-1

Affected Products

Debian

Ffmpeg

Ffmpeg-Dbg

Ffmpeg-Doc

Libavcodec-Dev

Libavcodec51

Libavdevice-Dev

Libavdevice52

References · 33

• 🔥 http://scarybeastsecurity.blogspot.com/2009/09/patching-ffmpeg-into-shape.html · Exploit
• http://mandriva.com/security/advisories?name=MDVSA-2011:112 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4632 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4640 · Security Note
• https://bdu.fstec.ru/vul/2015-02208 · Security Note
• https://bdu.fstec.ru/vul/2015-02202 · Security Note
• https://osv.dev/vulnerability/CVE-2009-4636 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4633 · Security Note
• http://debian.org/security/2010/dsa-2000 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-4636 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02205 · Security Note
• https://bdu.fstec.ru/vul/2015-02206 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2011:114 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:062 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4637 · Security Note