Release - New plugin "iPlayer WWW"

  Thread Rating:
  • 8 Vote(s) - 4.13 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Post Reply
Jeffers24 Offline
Fan
Posts: 453
Joined: Nov 2014
Reputation: 17
Location: England
Post: #1321
(2017-05-24 08:54)Jeffers24 Wrote:  
(2017-05-12 12:15)primaeval Wrote:  
(2017-05-12 12:06)Thebluevoice Wrote:  ^^^

Version 3 of the addon needs the addon InputStream Adaptive to be installed and enabled before you can install or upgrade it.
Some devices might not be able to install InputStream Adapative but Windows should be ok.

Kodi 17.1 \ System \ Addons \ My addons \ VideoPlayer InputStream \ InputStream Adaptive \ (right click) \ Information \ Enable

This option is no longer available in the Kodi 17.2 update Huh

Just installed Kodi 17.3 and the option is back Big Grin
find quote
Jeffers24 Offline
Fan
Posts: 453
Joined: Nov 2014
Reputation: 17
Location: England
Post: #1322
(2017-05-25 08:30)Martijn Wrote:  Simply don't use subtitles then and you're safe.

Great info.

Would you tell me how to disable/switch off subtitles to ensure I "Simply don't use them"?

I am in settings >player >language and can see options for subtitles, but not one to switch them on or off.
find quote
Martijn Offline
Team Kodi
Posts: 16,789
Joined: Jul 2011
Reputation: 308
Location: Dawn of time
Post: #1323
You already need to manually install a subtitles Addon to be vulnerable.
Also all this is way too hyped.

Read/follow the forum rules.
For troubleshooting and bug reporting, read this first
Interested in seeing some YouTube videos about Kodi? Go here and subscribe
(This post was last modified: 2017-05-25 09:27 by Martijn.)
find quote
primaeval Offline
Posting Freak
Posts: 1,690
Joined: Apr 2014
Reputation: 178
Post: #1324
(2017-05-25 09:26)Jeffers24 Wrote:  
(2017-05-25 08:30)Martijn Wrote:  Simply don't use subtitles then and you're safe.

Great info.

Would you tell me how to disable/switch off subtitles to ensure I "Simply don't use them"?

I am in settings >player >language and can see options for subtitles, but not one to switch them on or off.

Go to
System \ Add-ons \ Search \ subtitles

If there are any subtitle providers enabled in that list then disable them.

Kodi won't download subtitles without a subtitle provider being enabled first.

The iPlayerWWW subtitles are safe.
Local text subtitle files are safe.
DVD subtitles are safe.
find quote
Jeffers24 Offline
Fan
Posts: 453
Joined: Nov 2014
Reputation: 17
Location: England
Post: #1325
(2017-05-25 09:31)primaeval Wrote:  
(2017-05-25 09:26)Jeffers24 Wrote:  
(2017-05-25 08:30)Martijn Wrote:  Simply don't use subtitles then and you're safe.

Great info.

Would you tell me how to disable/switch off subtitles to ensure I "Simply don't use them"?

I am in settings >player >language and can see options for subtitles, but not one to switch them on or off.

Go to
System \ Add-ons \ Search \ subtitles

If there are any subtitle providers enabled in that list then disable them.

Kodi won't download subtitles without a subtitle provider being enabled first.

The iPlayerWWW subtitles are safe.
Local text subtitle files are safe.
DVD subtitles are safe.


Thanks, checked and no subtitles addons were enabled Nod
find quote
primaeval Offline
Posting Freak
Posts: 1,690
Joined: Apr 2014
Reputation: 178
Post: #1326
This is the best explanation of how the subtitles exploit can be used to hack your computer or Kodi device.
https://www.reddit.com/r/Addons4Kodi/com...r/dhzaxau/
Quote:Looking at the actual pull request containing the fix, it seems that the vulnerability itself was in the unzipping of subtitle archives and not checking to see if a file would get extracted into the parent directory. eg: if your .zip contained a file named ../.bashrc then if it happened to get extracted to overwrite your existing ~/.bashrc, the next time you open a shell, bash would end up executing the code. The subtitles themselves arent normally executed, but they can be extracted somewhere that overwrites a file that does get executed normally.

.bashrc can run anything like deleting your entire filesystem or sending your passwords to North Korea or adding your computers to a botnet.

If you have rooted your Android device or run Kodi as Administrator or root this is especially dangerous.
(This post was last modified: 2017-05-25 10:50 by primaeval.)
find quote
DarrenHill Offline
Team-Kodi Minion
Posts: 5,527
Joined: Oct 2014
Reputation: 125
Location: UK, except when I'm not.
Post: #1327
Basically if you're using 17.2 then you're safe from subtitles hackery, but a few add-ons (inc inputstream.adaptive) got missed in the build due to tagging issues.

17.3 fixed that, so if you're up to date then you're good for everything.

If you're subtitles are from a known good and trustworthy source (e.g. the BBC) then you're reasonably safe anyway, but the vulnerability is there pre 17.2 Kodi.

| Banned add-ons (wiki) | Forum rules (wiki) | First time user (wiki) | FAQs (wiki) | Troubleshooting (wiki) | Add-ons (wiki) | Free content (wiki) | Debug Log (wiki) |
find quote
primaeval Offline
Posting Freak
Posts: 1,690
Joined: Apr 2014
Reputation: 178
Post: #1328
This might affect the addon in a few months as they disentangle some of the BBC Store code.

BBC Store to close as Corporation admits defeat in the face of streaming service rivals
find quote
Post Reply