Segmentation Violation in GPAC MP4Box via Crafted MP4 File

Compliance Impact

The vulnerability described is a segmentation violation in GPAC MP4Box that allows a Denial of Service (DoS) attack via a crafted MP4 file. It impacts availability but does not affect confidentiality or integrity.

Since the vulnerability does not lead to data breach or unauthorized data access, it has limited direct impact on compliance with data protection regulations such as GDPR or HIPAA, which primarily focus on protecting personal data confidentiality and integrity.

However, the DoS condition could affect system availability, which is a component of some compliance frameworks. Organizations relying on GPAC MP4Box in critical systems should consider the risk of service disruption in their compliance risk assessments.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is a segmentation violation occurring in the Track_SetStreamDescriptor function within the isomedia/track.c file of GPAC MP4Box version 2.4. It allows attackers to cause a Denial of Service (DoS) by supplying a specially crafted MP4 file.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that an attacker can cause a Denial of Service (DoS) condition, which means the affected application or system using GPAC MP4Box v2.4 could crash or become unavailable when processing a maliciously crafted MP4 file.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the GPAC MP4Box application with a crafted MP4 file that contains an unknown svcC box inside an av01 parent box, which triggers a NULL pointer dereference and causes a segmentation fault.

To detect the issue on your system, you can run MP4Box with a proof-of-concept (PoC) malicious MP4 file and observe if the application crashes with a segmentation fault.

Example command to test MP4Box with a crafted file (replace crafted_file.mp4 with the PoC file):

• mp4box -info crafted_file.mp4

If MP4Box crashes or produces a segmentation fault during processing, it indicates the presence of the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include avoiding the use of untrusted or unverified MP4 files with GPAC MP4Box until a fixed version is applied.

Update GPAC MP4Box to a version that includes the fix commit 15a4ac2dff38cdbb8b43e7c84fb1595ee80d81ac or later, which addresses this NULL pointer dereference vulnerability.

If updating is not immediately possible, consider running MP4Box in a restricted environment or sandbox to limit the impact of potential crashes.

Useful 0 Not Useful 0