Segmentation Violation in GPAC Project MP4Box via Malicious XML File

Executive Summary

This vulnerability is a segmentation fault (SEGV) in GPAC's MP4Box tool caused by a NULL pointer dereference in the gf_isom_get_esd function. It occurs when processing an empty XML file with the -dnal option, leading to a crash due to unvalidated pointer access in media descriptor structures.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in GPAC's MP4Box tool when processing XML files with the -dnal option. Use AddressSanitizer or similar tools to catch segmentation faults. Check GPAC version against patched releases (post commit e6d0182).

Commands: Run MP4Box -dnal on test XML files and observe for crashes. Use gdb to debug MP4Box with a crafted empty XML file. Check system logs for MP4Box segmentation faults.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a Denial of Service (DoS) by crashing the MP4Box application when processing a specially crafted XML file. Users may experience application termination or system instability if the tool is used in automated workflows.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability is a segmentation fault caused by a NULL pointer dereference in GPAC's MP4Box tool when processing crafted XML files. It leads to a Denial of Service (DoS) but does not directly impact data confidentiality or integrity. Compliance with GDPR or HIPAA would depend on whether the affected system processes personal or health data, but the vulnerability itself does not inherently violate these standards.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update GPAC to version 2.5 or later to include the fix from commit e6d0182. Avoid using MP4Box with the -dnal option on untrusted XML files until patched.

If updating is not possible, disable MP4Box's -dnal functionality or restrict its use to trusted XML inputs only. Monitor for crashes as potential exploitation attempts.

Useful 0 Not Useful 0