A recent discovery revealed that a buffer overflow vulnerability exists in FLVMeta v1.2.1, a widely-used metadata editor for FLV video files. The vulnerability, designated as CVE-2023-36243, is found within the xml_on_metadata_tag_only function located in the dump_xml.c source code file. In this article, we'll delve into the details of this vulnerability, explain how it can be exploited, and recommend measures that can be employed both by developers and users to mitigate its potential impact.

What is FLVMeta?
FLVMeta is an open-source metadata injector and editor for FLV video files, enabling developers and users to modify, add, and analyze metadata embedded within the video files. For further information about FLVMeta, you can visit the project's website at https://www.flvmeta.com/.

The Vulnerability - CVE-2023-36243

The CVE-2023-36243 vulnerability is a buffer overflow caused by an improper bounds check within the xml_on_metadata_tag_only function of the dump_xml.c file. Essentially, when this function processes a specially-crafted FLV file, it can lead to the overflow of a buffer in memory, potentially resulting in the execution of arbitrary code, application crashes, or other undesirable outcomes.

Exploiting the Vulnerability

To exploit this vulnerability, an attacker needs to create a malicious FLV file with a malformed metadata block designed to trigger the buffer overflow. When the FLVMeta program processes this malicious file, the overflow occurs, allowing the attacker's code to be executed.

Let's take a closer look at the relevant code snippet from the dump_xml.c file

void xml_on_metadata_tag_only(const flvtag *tag) {
    xmlBuffer *str = xmlBufferCreate();
    flvtag_to_xml(tag, FLVMETA_OUTPUT_STYLE_ONELINE, str, sizeof(str));
    printf("%s", (const char *) str->content);
    xmlBufferFree(str);
}

In this code snippet, flvtag_to_xml() is called with an incorrect size for the str buffer. Instead of using the correct buffer size, sizeof(str) is used, which only returns the size of the pointer to the buffer, rather than the actual buffer size. This mistake can lead to an attacker being able to overwrite memory and potentially execute arbitrary code.

Mitigating the Vulnerability

To address this vulnerability, developers have released a patch that corrects the bounds check in the xml_on_metadata_tag_only function. Users are advised to update their FLVMeta installations to the latest patched version. You can refer to the FLVMeta GitHub repository for the updated source code and release information: https://github.com/noirotm/flvmeta.

After applying the patch, the fixed code should look like this

void xml_on_metadata_tag_only(const flvtag *tag) {
    xmlBuffer *str = xmlBufferCreate();
    flvtag_to_xml(tag, FLVMETA_OUTPUT_STYLE_ONELINE, str, xmlBufferLength(str));
    printf("%s", (const char *) str->content);
    xmlBufferFree(str);
}

Notice that sizeof(str) has been replaced with xmlBufferLength(str), which provides the correct buffer size for the flvtag_to_xml() function.

Conclusion

In summary, by keeping your FLVMeta installation up to date with the latest patch and following best practices for handling untrusted FLV files, both developers and users can protect themselves from the CVE-2023-36243 vulnerability. As always, it's crucial to be vigilant and proactive when dealing with potential security risks in any software.

Timeline

Published on: 06/22/2023 19:15:00 UTC
Last modified on: 06/29/2023 21:02:00 UTC