Out-of-Memory DoS in GPAC MP4Box

Executive Summary

This vulnerability is an Out-of-Memory issue in the mp4_mux_cenc_insert_pssh function within the GPAC MP4Box software version 2.4. It occurs when the function processes a specially crafted MP4 file, which can cause the program to consume excessive memory.

The vulnerability allows attackers to trigger a Denial of Service (DoS) condition by supplying such a crafted MP4 file.

Useful 0 Not Useful 0

Impact Analysis

The primary impact of this vulnerability is a Denial of Service (DoS). An attacker can cause the GPAC MP4Box application to crash or become unresponsive by providing a maliciously crafted MP4 file.

This could disrupt services or workflows that rely on MP4Box for processing MP4 files, potentially leading to downtime or loss of availability.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for crashes or out-of-memory conditions when GPAC MP4Box processes MP4 files, especially those containing crafted Protection System Specific Header (PSSH) metadata.

One practical approach is to test MP4Box with known proof-of-concept (PoC) files that exploit this vulnerability to observe if the application crashes or reports memory allocation errors.

Since the issue arises during processing of MP4 files, you can use commands to analyze or scan MP4 files for suspiciously large or malformed PSSH boxes.

• Use GPAC MP4Box to process suspect MP4 files and watch for crashes or errors: `MP4Box -dash 1000 suspicious_file.mp4`
• Use tools like `ffprobe` or `mp4dump` to inspect the PSSH box sizes and metadata fields for abnormal values.
• Monitor system logs or application output for out-of-memory errors or crashes related to MP4Box.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update GPAC MP4Box to a version that includes the fix for this vulnerability, as addressed in commit e95f3064d846e4606276fff111e0f97df1576a04.

Until the update can be applied, avoid processing untrusted or suspicious MP4 files that may contain maliciously crafted PSSH metadata.

Implement input validation or filtering to block or quarantine MP4 files with unusually large or malformed PSSH boxes before they are processed by MP4Box.

Monitor your systems for signs of crashes or out-of-memory conditions related to MP4Box usage.

Useful 0 Not Useful 0