{"id":105225,"date":"2022-10-01T09:36:48","date_gmt":"2022-10-01T07:36:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-ffmpeg-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-mp4-fajlov"},"modified":"2022-10-01T09:36:48","modified_gmt":"2022-10-01T07:36:48","slug":"uyazvimost-v-ffmpeg-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-mp4-fajlov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-ffmpeg-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-mp4-fajlov","title":{"rendered":"Zranitelnost v FFmpeg, kter\u00e1 umo\u017e\u0148uje vykon\u00e1n\u00ed k\u00f3du p\u0159i zpracov\u00e1n\u00ed mp4 soubor\u016f","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Bezpe\u010dnostn\u00ed v\u00fdzkumn\u00edci z firmy Google zjistili zranitelnost (CVE-2022-2566) v knihovn\u011b libavformat, kter\u00e1 je sou\u010d\u00e1st\u00ed multimedi\u00e1ln\u00edho bal\u00edku FFmpeg. Tato zranitelnost umo\u017e\u0148uje \u00fato\u010dn\u00edkovi prov\u00e9st k\u00f3d p\u0159i zpracov\u00e1n\u00ed speci\u00e1ln\u011b upraven\u00e9ho souboru ve form\u00e1tu mp4 na c\u00edlov\u00e9m syst\u00e9mu. Zranitelnost se projevuje od verze FFmpeg 5.1 a byla odstran\u011bna v aktualizaci FFmpeg 5.1.2. <\/p>\n

Zranitelnost je zp\u016fsobena chybou ve v\u00fdpo\u010dtu velikosti bufferu ve funkci build_open_gop_key_points(), kter\u00e1 vede k p\u0159ete\u010den\u00ed cel\u00e9ho \u010d\u00edsla p\u0159i zpracov\u00e1n\u00ed ur\u010dit\u00fdch parametr\u016f a k alokaci bloku pam\u011bti, jeho\u017e velikost je men\u0161\u00ed, ne\u017e je pot\u0159eba. Pro demonstraci mo\u017enosti \u00fatoku byl zve\u0159ejn\u011bn prototyp exploit.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-2566) \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libavformat, \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u0439 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 FFmpeg. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0436\u0435\u0440\u0442\u0432\u044b \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0438\u0437\u043c\u0435\u043d\u0451\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 mp4. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0442\u043a\u0438 FFmpeg 5.1 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 FFmpeg 5.1.2. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432\u044b\u0447\u0438\u0441\u043b\u0435\u043d\u0438\u044f \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105225","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost v FFmpeg, kter\u00e1 umo\u017e\u0148uje prov\u00e9st k\u00f3d p\u0159i zpracov\u00e1n\u00ed mp4 soubor\u016f | ProHoster","description":"Bezpe\u010dnostn\u00ed v\u00fdzkumn\u00edci z firmy Google zjistili zranitelnost (CVE-2022-2566) v knihovn\u011b libavformat, kter\u00e1 je sou\u010d\u00e1st\u00ed multimedi\u00e1ln\u00edho bal\u00edku FFmpeg.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-ffmpeg-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-mp4-fajlov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 FFmpeg, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 mp4-\u0444\u0430\u0439\u043b\u043e\u0432 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-2566) \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libavformat, \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u0439 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 FFmpeg.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-ffmpeg-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-mp4-fajlov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-10-01T07:36:48+00:00","article:modified_time":"2022-10-01T07:36:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/105225","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=105225"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/105225\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=105225"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=105225"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=105225"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}