Yusuf Motiwala’s Blog

Recent discovery of a buffer overrun bug in flash player could be fatal for online video lovers. By using a specially crafted “flv” video, it is possible to trigger a buffer overflow in adobe flash player which could lead to a browser crash or an arbitrary code execution, Minded Security reported today.

It did not take much time to create a demo of this bug. I created a small flv video, modified to exploit this bug and uploaded to youtube which may crash your browser when played. Here is link, try it at your own risk

 http://www.youtube.com/v/ULzxwmV5QgI
 http://www.youtube.com/watch?v=ULzxwmV5QgI

FLV is widely used format for online video sharing used by yourtube, blip etc. Today, when millions of videos are streamed everyday, and few hundred thousands videos gets uploaded, this bug may prove to be very dangerous.

While Adobe released updated version of their flash player which addresses this bug, large number of users are not computer savvy enough to be aware of this bug or can update their player themselves. Hence, it would be worth if online video sharing web sites like youtube can check for any malformed uploaded file before publishing. Btw, it is worth mentioning that an open source video player (VLC) did not crash while playing this malformed flv.

Source: Minded Security

Update: Youtube decided to delete this video marking it as “content inappropriate” (see screenshot below). As one can see from the thousands of views and numerous comments received on this video that it served good purpose of let people be aware of this problem and upgrade their software. However, youtube does not seem to be thinking positive - may be they will like someone with hidden agenda. What do readers feel?

Share This

del.icio.us Digg Furl Reddit StumbleUpon OnlyWire

I would like to hear your ideas, critics, suggestions or feedback on this post. Thanks for leaving your reply.