CVE-2020-35979
📋 TL;DR
This CVE describes a heap-based buffer overflow vulnerability in GPAC's RTP builder function for AVC video. Attackers can exploit this to execute arbitrary code or cause denial of service by sending specially crafted RTP packets. Users of GPAC versions 0.8.0 and 1.0.1 are affected.
💻 Affected Systems
- GPAC (MP4Box, MP4Client, other GPAC tools)
📦 What is this software?
Gpac by Gpac
Gpac by Gpac
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or persistent backdoor installation.
Likely Case
Application crash causing denial of service, potentially disrupting media processing services.
If Mitigated
Limited impact with proper network segmentation and exploit prevention controls in place.
🎯 Exploit Status
Exploitation requires sending malformed RTP packets to the vulnerable function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit b15020f54aff24aaeb64b80771472be8e64a7adc and later versions
Vendor Advisory: https://github.com/gpac/gpac/commit/b15020f54aff24aaeb64b80771472be8e64a7adc
Restart Required: Yes
Instructions:
1. Update GPAC to version after commit b15020f. 2. Recompile from source if using custom build. 3. Restart all GPAC services.
🔧 Temporary Workarounds
Network Filtering
linuxBlock or filter RTP traffic to GPAC services from untrusted sources.
iptables -A INPUT -p udp --dport 5004:5005 -j DROP # Example RTP ports
Service Isolation
linuxRun GPAC services in isolated containers or VMs with limited privileges.
docker run --cap-drop=ALL --security-opt=no-new-privileges gpac-container
🧯 If You Can't Patch
- Implement strict network segmentation to isolate GPAC services from untrusted networks.
- Deploy exploit prevention controls like ASLR and DEP, and run GPAC with minimal privileges.
🔍 How to Verify
Check if Vulnerable:
Check GPAC version: mp4box -version or gpac -version. If output shows 0.8.0 or 1.0.1, system is vulnerable.Check Version:
mp4box -version 2>&1 | head -1Verify Fix Applied:
Verify version is updated beyond vulnerable versions and test with sample RTP streams.📡 Detection & Monitoring
Log Indicators:
- GPAC crash logs
- segmentation fault errors in system logs
- unexpected process termination
Network Indicators:
- Unusual RTP traffic patterns to GPAC services
- malformed RTP packet detection
SIEM Query:
source="*gpac*" AND ("segmentation fault" OR "buffer overflow" OR "SIGSEGV")