CVE-2010-3429: Code Injection
flicvideo.c in libavcodec 0.6 and earlier in FFmpeg, as used in MPlayer and other products, allows remote attackers to execute arbitrary code via a crafted flic file, related to an "arbitrary offset dereference vulnerability."
Other sources
oCERT reported a vulnerability that affects the flic video codec support in ffmpeg. Quoting:
"The MPlayer package [1] is vulnerable to an arbitrary offset dereference vulnerability, which could be exploited by malicious remote attacker. The vulnerability is caused by the MPlayer's flic codec (flicvideo.c) on 8 bits per pixel videos because the codec does not check received values. This could be exploited jumping to arbitrary code by opening a specially crafted file."
They were particularly concerned about the ffmpeg inclusion in mplayer. The affected file (flicvideo.c) is also present in libextractor as provided by Fedora 12. It looks as though the only thing using libextractor in Fedora is doodle (local search program, like Spotlight). This would mean a user would have to download a specially crafted file and store it locally, and be using doodle to index files. I don't know whether or not doodle would be problematic here, i.e. if it's just reading metadata it might not cause any problems at all.
Later versions of libextractor have removed the embedded ffmpeg sources.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3429?
CVE-2010-3429 is considered a critical vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2010-3429?
To fix CVE-2010-3429, upgrade to a version of FFmpeg or libavcodec that is later than 0.6.
What products are affected by CVE-2010-3429?
CVE-2010-3429 affects FFmpeg versions up to 0.6, and the libavcodec library used in MPlayer and other applications.
What kind of attack can exploit CVE-2010-3429?
CVE-2010-3429 can be exploited by remote attackers through crafted Flic files leading to arbitrary code execution.
Is CVE-2010-3429 still relevant today?
Though it was reported in 2010, CVE-2010-3429 may still be relevant for systems running outdated versions of affected software.