Vulnerabilities > CVE-2019-12730 - Use of Uninitialized Resource vulnerability in Ffmpeg

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
ffmpeg
CWE-908
nessus

Summary

aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitialized variables.

Vulnerable Configurations

Part Description Count
Application
Ffmpeg
312

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4502.NASL
    descriptionSeveral vulnerabilities have been discovered in the FFmpeg multimedia framework, which could result in denial of service or potentially the execution of arbitrary code if malformed files/streams are processed.
    last seen2020-06-01
    modified2020-06-02
    plugin id127929
    published2019-08-20
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127929
    titleDebian DSA-4502-1 : ffmpeg - security update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-4502. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(127929);
      script_version("1.2");
      script_cvs_date("Date: 2020/01/02");
    
      script_cve_id("CVE-2019-12730");
      script_xref(name:"DSA", value:"4502");
    
      script_name(english:"Debian DSA-4502-1 : ffmpeg - security update");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Several vulnerabilities have been discovered in the FFmpeg multimedia
    framework, which could result in denial of service or potentially the
    execution of arbitrary code if malformed files/streams are processed."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/source-package/ffmpeg"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/buster/ffmpeg"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2019/dsa-4502"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the ffmpeg packages.
    
    For the stable distribution (buster), this problem has been fixed in
    version 7:4.1.4-1~deb10u1."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:ffmpeg");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:10.0");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/06/04");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/08/16");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/08/20");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"10.0", prefix:"ffmpeg", reference:"7:4.1.4-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"ffmpeg-doc", reference:"7:4.1.4-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"libavcodec-dev", reference:"7:4.1.4-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"libavcodec-extra", reference:"7:4.1.4-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"libavcodec-extra58", reference:"7:4.1.4-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"libavcodec58", reference:"7:4.1.4-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"libavdevice-dev", reference:"7:4.1.4-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"libavdevice58", reference:"7:4.1.4-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"libavfilter-dev", reference:"7:4.1.4-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"libavfilter-extra", reference:"7:4.1.4-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"libavfilter-extra7", reference:"7:4.1.4-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"libavfilter7", reference:"7:4.1.4-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"libavformat-dev", reference:"7:4.1.4-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"libavformat58", reference:"7:4.1.4-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"libavresample-dev", reference:"7:4.1.4-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"libavresample4", reference:"7:4.1.4-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"libavutil-dev", reference:"7:4.1.4-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"libavutil56", reference:"7:4.1.4-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"libpostproc-dev", reference:"7:4.1.4-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"libpostproc55", reference:"7:4.1.4-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"libswresample-dev", reference:"7:4.1.4-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"libswresample3", reference:"7:4.1.4-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"libswscale-dev", reference:"7:4.1.4-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"libswscale5", reference:"7:4.1.4-1~deb10u1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-202003-65.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-202003-65 (FFmpeg: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in FFmpeg. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user or automated system using FFmpeg to process a specially crafted file, resulting in the execution of arbitrary code or a Denial of Service. Workaround : There is no known workaround at this time.
    last seen2020-04-04
    modified2020-03-31
    plugin id135020
    published2020-03-31
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135020
    titleGLSA-202003-65 : FFmpeg: Multiple vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 202003-65.
    #
    # The advisory text is Copyright (C) 2001-2020 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(135020);
      script_version("1.2");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/02");
    
      script_cve_id("CVE-2018-10001", "CVE-2018-6912", "CVE-2018-7557", "CVE-2018-7751", "CVE-2018-9841", "CVE-2019-12730", "CVE-2019-13312", "CVE-2019-13390", "CVE-2019-17539", "CVE-2019-17542");
      script_xref(name:"GLSA", value:"202003-65");
    
      script_name(english:"GLSA-202003-65 : FFmpeg: Multiple vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-202003-65
    (FFmpeg: Multiple vulnerabilities)
    
        Multiple vulnerabilities have been discovered in FFmpeg. Please review
          the CVE identifiers referenced below for details.
      
    Impact :
    
        A remote attacker could entice a user or automated system using FFmpeg
          to process a specially crafted file, resulting in the execution of
          arbitrary code or a Denial of Service.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/202003-65"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All FFmpeg 4.x users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=media-video/ffmpeg-4.2.0'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:ffmpeg");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/02/12");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/03/30");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/03/31");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"media-video/ffmpeg", unaffected:make_list("ge 4.2.0"), vulnerable:make_list("ge 4"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "FFmpeg");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-3184-1.NASL
    descriptionThis update for ffmpeg fixes the following issues : Security issues fixed : CVE-2019-17542: Fixed a heap-buffer overflow in vqa_decode_chunk due to an out-of-array access (bsc#1154064). CVE-2019-12730: Fixed an uninitialized use of variables due to an improper check (bsc#1137526). CVE-2019-9718: Fixed a denial of service in the subtitle decode (bsc#1129715). CVE-2018-13301: Fixed a denial of service while converting a crafted AVI file to MPEG4 (bsc#1100352). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id131756
    published2019-12-06
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131756
    titleSUSE SLED15 / SLES15 Security Update : ffmpeg (SUSE-SU-2019:3184-1)