製品・ソフトウェアに関する情報

JVN脆弱性詳細

FFmpeg における cross-origin 攻撃を実行される脆弱性

Title	FFmpeg における cross-origin 攻撃を実行される脆弱性
Summary	FFmpeg には、cross-origin 攻撃を実行され、任意のファイルを読まれる脆弱性が存在します。なお、JVNVU#92302510 では、CWE-201 として公開されています。 CWE-201: Information Exposure Through Sent Data http://cwe.mitre.org/data/definitions/201.html
Possible impacts	第三者により、HTTP Live Streaming (HLS) M3U8 ファイルのサブファイルのプロトコルを使用して、ローカルファイルの任意の行を含む URL 文字列を持つ外部 HTTP リクエストを実行されることで、cross-origin 攻撃を実行され、任意のファイルを読まれる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Jan. 14, 2016, midnight
Registration Date	Jan. 26, 2016, 2:23 p.m.
Last Update	Jan. 26, 2016, 2:23 p.m.

CVSS2.0 : 警告
Score	4.3
Vector	AV:N/AC:M/Au:N/C:P/I:N/A:N

Affected System

FFmpeg

FFmpeg 2.x

Libav

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-1898	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1898
National Vulnerability Database (NVD)
2	CVE-2016-1898	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1898

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html
2	CWE-Other	https://www.ipa.go.jp/security/vuln/CWE.html#CWEOther

ベンダー情報

No	Name	URL
FFmpeg
1	Top Page	http://www.ffmpeg.org/
Libav
2	Top Page	http://www.libav.org/

その他

No	Name	URL
JVN
1	JVNVU#92302510	http://jvn.jp/vu/JVNVU92302510/index.html
US-CERT Vulnerability Note
2	VU#772447	https://www.kb.cert.org/vuls/id/772447
関連文書
3	How to handle media files from untrusted sources?	http://security.stackexchange.com/questions/110644/how-to-handle-media-files-from-untrusted-sources
4	Re: Fwd: FFmpeg: stealing local files with HLS+concat	http://www.openwall.com/lists/oss-security/2016/01/14/1
5	Опасное видео: как я нашёл уязвимость в видеохостингах и не умер через 7 дней	http://habrahabr.ru/company/mailru/blog/274855/

Change Log

No	Changed Details	Date of change
0	[2016年01月26日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2016-1898

Summary	FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming (HLS) M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file.
Publication Date	Jan. 15, 2016, 12:59 p.m.
Registration Date	Jan. 26, 2021, 2:08 p.m.
Last Update	Nov. 21, 2024, 11:47 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:ffmpeg:ffmpeg:2.2.12:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4.11:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.3:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.6.3:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.8:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.3.3:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4.4:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.0.7:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.6.6:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4.1:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.8.4:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.0.4:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.4:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.1.6:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.6:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4.9:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.7.1:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.3:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4.6:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.5.6:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.3.5:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.5.4:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4.10:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.1:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.15:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.6.2:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.7:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4.3:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.0:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.0.3:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.14:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.5:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.6:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.5.5:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.8.2:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4.7:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.1.3:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.8.1:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4.2:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.7.3:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.0.2:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.6.4:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4.5:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.3.2:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.6.5:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.8:dev::::::
cpe:2.3:a:ffmpeg:ffmpeg:2.3.6:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.9:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.5.8:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4.8:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.1.5:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.1.8:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.7.2:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.8:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.0.1:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.1.1:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.1.4:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.5.9:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.7.4:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.1.7:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.11:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.8.3:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.5.3:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.10:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.3.4:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.1:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.13:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.16:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.3.1:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.6.1:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.0.6:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4.12:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.7:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.5.1:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.5:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.5.7:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.2:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.1.2:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.0.5:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.5.2:::::::*

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:12.04::::lts:::

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:opensuse:leap:42.1:::::::*

Related information, measures and tools

No	URL	タグ
1	http://habrahabr.ru/company/mailru/blog/274855	Exploit
2	http://habrahabr.ru/company/mailru/blog/274855	Exploit
3	http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00034.html
4	http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00034.html
5	http://www.debian.org/security/2016/dsa-3506
6	http://www.debian.org/security/2016/dsa-3506
7	http://www.openwall.com/lists/oss-security/2016/01/14/1
8	http://www.openwall.com/lists/oss-security/2016/01/14/1
9	http://www.securityfocus.com/bid/80501
10	http://www.securityfocus.com/bid/80501
11	http://www.securitytracker.com/id/1034932
12	http://www.securitytracker.com/id/1034932
13	http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.529036
14	http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.529036
15	http://www.ubuntu.com/usn/USN-2944-1
16	http://www.ubuntu.com/usn/USN-2944-1
17	https://security.gentoo.org/glsa/201606-09
18	https://security.gentoo.org/glsa/201606-09
19	https://security.gentoo.org/glsa/201705-08
20	https://security.gentoo.org/glsa/201705-08
21	https://www.kb.cert.org/vuls/id/772447
22	https://www.kb.cert.org/vuls/id/772447

Common Vulnerabilities List

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:ffmpeg:ffmpeg:2.2.12:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4.11:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.3:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.6.3:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.8:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.3.3:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4.4:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.0.7:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.6.6:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4.1:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.8.4:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.0.4:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.4:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.1.6:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.6:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4.9:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.7.1:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.3:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4.6:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.5.6:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.3.5:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.5.4:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4.10:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.1:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.15:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.6.2:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.7:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4.3:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.0:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.0.3:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.14:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.5:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.6:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.5.5:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.8.2:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4.7:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.1.3:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.8.1:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4.2:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.7.3:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.0.2:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.6.4:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4.5:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.3.2:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.6.5:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.8:dev::::::
cpe:2.3:a:ffmpeg:ffmpeg:2.3.6:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.9:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.5.8:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4.8:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.1.5:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.1.8:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.7.2:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.8:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.0.1:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.1.1:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.1.4:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.5.9:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.7.4:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.1.7:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.11:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.8.3:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.5.3:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.10:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.3.4:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.1:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.13:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.16:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.3.1:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.6.1:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.0.6:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.4.12:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.7:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.5.1:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.5:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.5.7:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.2.2:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.1.2:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.0.5:::::::*
cpe:2.3:a:ffmpeg:ffmpeg:2.5.2:::::::*