CVE-2017-14054

In libavformat/rmdec.c in FFmpeg 3.3.3, a DoS in ivr_read_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted IVR file, which claims a large "len" field in the header but does not contain sufficient backing data, is provided, the first type==4 loop would consume huge CPU resources, since there is no EOF check inside the loop.

CVSS v3 6.5 MEDIUM
CVSS v2.0 7.1 HIGH

6.5^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

7.1^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:N/I:N/A:C

Exploitability : 8.6 / Impact : 6.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
http://www.debian.org/security/2017/dsa-3996
http://www.securityfocus.com/bid/100627
https://github.com/FFmpeg/FFmpeg/commit/124eb202e70678539544f6268efc98131f19fa49	Patch Third Party Advisory
http://www.debian.org/security/2017/dsa-3996
http://www.securityfocus.com/bid/100627
https://github.com/FFmpeg/FFmpeg/commit/124eb202e70678539544f6268efc98131f19fa49	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ffmpeg:ffmpeg:3.3.3:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-08-31 15:29

Updated : 2025-04-20 01:37

NVD link : CVE-2017-14054

Mitre link : CVE-2017-14054

CVE.ORG link : CVE-2017-14054

JSON object : View

Products Affected

ffmpeg

ffmpeg

CWE

CWE-834

Excessive Iteration

{"id": "CVE-2017-14054", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.1, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2017-08-31T15:29:00.247", "references": [{"url": "http://www.debian.org/security/2017/dsa-3996", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/100627", "source": "cve@mitre.org"}, {"url": "https://github.com/FFmpeg/FFmpeg/commit/124eb202e70678539544f6268efc98131f19fa49", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.debian.org/security/2017/dsa-3996", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/100627", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/FFmpeg/FFmpeg/commit/124eb202e70678539544f6268efc98131f19fa49", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-834"}]}], "descriptions": [{"lang": "en", "value": "In libavformat/rmdec.c in FFmpeg 3.3.3, a DoS in ivr_read_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted IVR file, which claims a large \"len\" field in the header but does not contain sufficient backing data, is provided, the first type==4 loop would consume huge CPU resources, since there is no EOF check inside the loop."}, {"lang": "es", "value": "En libavformat/rmdec.c en FFmpeg 3.3.3, se podr\u00eda realizar un ataque de denegaci\u00f3n de servicio en ivr_read_header() al no haber un chequeo EOF (End Of File) que podr\u00eda provocar acabar en un gran consumo de CPU. Cuando se env\u00eda un archivo IVR manipulado que reclama un campo \"len\" grande en la cabecera pero que no contiene suficientes datos de respaldo, el primer bucle type==4 consumir\u00eda una gran cantidad de recursos de CPU, ya que no hay ning\u00fan chequeo EOF en el bucle."}], "lastModified": "2025-04-20T01:37:25.860", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:3.3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A97A44A7-DFB8-4DA8-8A4A-DBC1FF255D9A"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}