Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[drsea]

have read recently that many media center programs have been hit by malware which executes code from downloaded .srt files.

Is there any way that JRiver media center could fall prey to such malicious code?

exploit overview is presented here:
http://blog.checkpoint.com/2017/05/23/hacked-in-translation/

I don't have details of how the exploit is carried out, they were not provided, but there was a list of several common media players with the vulnerability, and information that they have been patched.
Thanks!
-rc-

[Al ex]

Not so good news. I thought these .set files are more or less simple text files.

[JohnT]

We did some checking and don't think Media Center is vulnerable to this attack.  The Checkpoint blog post alluded to potential threats if the subtitle parsing code used by a media player had exploitable bugs.  We've looked at our code and don't see anything obvious like a buffer overrun bug.  The Kodi player team made a fix that involved thwarting a possible "path traversal" type attack when the program unzips a downloaded subtitle file.  This is where a malicious zip file might contain files with paths that purposely overwrite system files and replace them with ones containing the hacker's malicious code.  When we grab subtitles from OpenSubtitles.org, we don't unzip directly to a file but instead read the uncompressed data on the fly, so MC isn't vulnerable to that attack either.

[JimH]

Thanks for reporting it.

[Al ex]

We did some checking and don't think Media Center is vulnerable to this attack.  The Checkpoint blog post alluded to potential threats if the subtitle parsing code used by a media player had exploitable bugs.  We've looked at our code and don't see anything obvious like a buffer overrun bug.  The Kodi player team made a fix that involved thwarting a possible "path traversal" type attack when the program unzips a downloaded subtitle file.  This is where a malicious zip file might contain files with paths that purposely overwrite system files and replace them with ones containing the hacker's malicious code.  When we grab subtitles from OpenSubtitles.org, we don't unzip directly to a file but instead read the uncompressed data on the fly, so MC isn't vulnerable to that attack either.

Thanks for looking into it, glad to hear...

[drsea]

I appreciate the response.  I download my own subtitle files, usually in .srt format, but saw that the Kodi example of the exploit occured with a user downloaded file, which worried me.  I usually don't parse the code of the downloaded file except to see that the subtitles are in sync and appropriate. 

I am pleased that you are attentive to the details discussed in the forum, and that there does not appear to be any vulnerability.

thanks again.
-rc-

[audioriver]

Thanks for looking into this. Hope the situation doesn't get out of hand, with increasingly dangerous subtitle files etc.

[Von]

Could this be why Rising Antivirus according to VirusTotal.com gives the following result?

Malware.Heuristic!ET#95% (cloud:vYPtTPTFdzU)