Access Violation in MPC-BE via Malicious MP4 File

Executive Summary

This vulnerability is an access violation in the BaseSplitterFile::Read function of Aleksoid1978 MPC-BE software versions before a specific commit (4341cb3). It allows attackers to cause a Denial of Service (DoS) by using a specially crafted MP4 file.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability in Aleksoid1978 MPC-BE involves processing crafted MP4 files that cause an access violation. Detection can involve monitoring for crashes or denial-of-service symptoms when opening or processing MP4 files.

Although no specific commands are provided for Aleksoid1978 MPC-BE, a similar MP4-related vulnerability in Bento4 was detected using the `mp4info` tool to process malformed MP4 files, which triggered errors.

Therefore, you might attempt to scan or test MP4 files with tools that parse MP4 containers (like `mp4info` in Bento4) to identify malformed files that could trigger the vulnerability.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that an attacker can cause the affected software to crash or become unresponsive, resulting in a Denial of Service (DoS). This means legitimate users may be unable to use the MPC-BE application properly when processing malicious MP4 files.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not include any details on how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include avoiding opening or processing untrusted or suspicious MP4 files with vulnerable versions of Aleksoid1978 MPC-BE.

Since the vulnerability is caused by crafted MP4 files leading to denial-of-service, restricting or filtering such files before they reach vulnerable software can reduce risk.

Additionally, updating to a fixed or later version of the software (if available) that addresses the vulnerability is recommended.

Useful 0 Not Useful 0