CVE-2018-10790
📋 TL;DR
This vulnerability in Bento4's AP4_CttsAtom class allows remote attackers to cause denial of service through application crashes by triggering memory allocation failures. It affects systems using Bento4 1.5.1.0 for media processing, particularly when handling malicious MP4 files.
💻 Affected Systems
- Bento4
📦 What is this software?
Bento4 by Axiosys
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption through repeated application crashes, potentially affecting media processing pipelines or applications relying on Bento4 library.
Likely Case
Application crashes when processing specially crafted media files, leading to temporary service unavailability.
If Mitigated
Limited impact with proper input validation and resource monitoring in place.
🎯 Exploit Status
Demonstrated via mp2aac tool; exploitation requires crafting malicious MP4 files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5.1.1 and later
Vendor Advisory: https://github.com/axiomatic-systems/Bento4/issues/390
Restart Required: Yes
Instructions:
1. Update Bento4 to version 1.5.1.1 or later. 2. Recompile any applications using Bento4 library. 3. Restart affected services.
🔧 Temporary Workarounds
Input validation for media files
allImplement strict validation of MP4 files before processing with Bento4
Resource limits
linuxSet memory allocation limits for Bento4 processes
ulimit -v [memory_limit_in_kb]
🧯 If You Can't Patch
- Isolate Bento4 processing to dedicated containers with resource constraints
- Implement network segmentation to limit exposure of media processing services
🔍 How to Verify
Check if Vulnerable:
Check Bento4 version: bento4 --version or examine library version in applicationsCheck Version:
bento4 --versionVerify Fix Applied:
Verify version is 1.5.1.1 or later and test with known malicious MP4 samples📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory allocation errors
- Segmentation faults in Bento4 processes
Network Indicators:
- Unusual media file uploads to processing endpoints
SIEM Query:
process_name:"bento4" AND (event_type:"crash" OR error:"memory allocation")