PT-2023-16993 · Mp4V2 · Mp4V2

Ccpx · Published 2023-03-17 · Updated 2024-05-17 · CVE-2023-1451

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions MP4v2 version 2.1.2

Description A vulnerability was found in the function mp4v2::impl::MP4Track::GetSampleFileOffset of the file mp4track.cpp. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.

Recommendations For MP4v2 version 2.1.2, consider disabling the mp4v2::impl::MP4Track::GetSampleFileOffset function until a patch is available. Restrict access to the mp4track.cpp file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

CVE-2023-1451

Affected Products

Mp4V2

References · 11

• 🔥 https://github.com/RichTrouble/mp4v2_mp4track_poc/blob/main/id_000000%2Csig_08%2Csrc_001076%2Ctime_147809374%2Cexecs_155756872%2Cop_havoc%2Crep_8 · Exploit
• 🔥 https://github.com/RichTrouble/mp4v2_mp4track_poc · Exploit
• https://ubuntu.com/security/CVE-2023-1451 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1451 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-1451 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-1451 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1451 · Vendor Advisory
• https://vuldb.com/?id.223296 · Note
• https://t.me/cvenotify/46368 · Telegram Post
• https://vuldb.com/?ctiid.223296 · Note
• https://t.me/cibsecurity/60237 · Telegram Post