Latest Subtitle VNC hack
#1
Hi
Did you fixed the security risk of remote control pc by downloadig subtitel via kodi?
Checkpoint report:
https://www.checkpoint.com/defense/advis...-0364.html

Thanks
Yoav
Reply
#2
how to find out if you were hit by it?
Reply
#3
I also came in to try and make sense of this. I read the news on The Register.
https://www.theregister.co.uk/2017/05/23...es_return/

Little video on there shows how it works in both VLC and KODI

In the comments ( https://forums.theregister.co.uk/forum/1...es_return/ ) someone pointed out the issue is caused by the subtitles being downloaded in a zip file. When the zip file is unpacked there is no check on a directory traversal. So a file can be unpacked as ../blah putting it in the directory above. I assume this then is how they drop their payload they want to run.

So... for now, manually download your subs and check the zip file. Inside the zip should just be text files you can check in Notepad.


I don't know if this is a bug in the subtitles addon, or in the zip file unpacker. Or a bit of both.
Reply
#4
we fixed the issue recently: https://github.com/xbmc/xbmc/pull/12024
it's included in the upcoming kodi v17.2 release
Do not PM or e-mail Team-Kodi members directly asking for support.
Always read the Forum rules, Kodi online-manual, FAQ, Help and Search the forum before posting.
Reply
#5
and there it is: kodi-v172-minor-bug-fix-and-security-release
Do not PM or e-mail Team-Kodi members directly asking for support.
Always read the Forum rules, Kodi online-manual, FAQ, Help and Search the forum before posting.
Reply
#6
Cool, thank you all.
Reply
#7
Anybody see this article? According to this article https://www.helpnetsecurity.com/2017/05/...itle-hack/
there is an updated fixed version of Kodi that prevents remote control access to your Kodi box. Is it posted yet on this website? How can I tell if I have a patched version?

Thanks for the info.
Reply
#8
@nassausky

Please read here.... https://kodi.tv/article/kodi-v172-minor-...ty-release
My Signature
Links to : Official:Forum rules (wiki) | Official:Forum rules/Banned add-ons (wiki) | Debug Log (wiki)
Links to : HOW-TO:Create Music Library (wiki) | HOW-TO:Create_Video_Library (wiki)  ||  Artwork (wiki) | Basic controls (wiki) | Import-export library (wiki) | Movie sets (wiki) | Movie universe (wiki) | NFO files (wiki) | Quick start guide (wiki)
Reply
#9
Moved to subtitle forum and merged into existing thread on same topic.
My Signature
Links to : Official:Forum rules (wiki) | Official:Forum rules/Banned add-ons (wiki) | Debug Log (wiki)
Links to : HOW-TO:Create Music Library (wiki) | HOW-TO:Create_Video_Library (wiki)  ||  Artwork (wiki) | Basic controls (wiki) | Import-export library (wiki) | Movie sets (wiki) | Movie universe (wiki) | NFO files (wiki) | Quick start guide (wiki)
Reply
#10
Came here after fumbling my way around the forums a bit and glad to see this subtitle vulnerability is fixed in 17.2 Nod
So great work seeing this fix so quickly Big Grin

I first looked under "Kodi related discussions" thinking it was a logical place to start my search and quickly found the closed thread Booby trapped subtitles.
However Martijn's answer within Booby trapped subtitles points to a dead link.
Same here.
I guess this is a result of the merge and move of this thread Blush

To help others find this thread more easily, maybe a moderator (or Martijn himself if he has required privileges) can please fix the above links to point to this thread Tongue
I'm a XBMC novice :)
Reply
#11
@skylarking.

Thanks for the heads up. Fixed.
My Signature
Links to : Official:Forum rules (wiki) | Official:Forum rules/Banned add-ons (wiki) | Debug Log (wiki)
Links to : HOW-TO:Create Music Library (wiki) | HOW-TO:Create_Video_Library (wiki)  ||  Artwork (wiki) | Basic controls (wiki) | Import-export library (wiki) | Movie sets (wiki) | Movie universe (wiki) | NFO files (wiki) | Quick start guide (wiki)
Reply
#12
Your welcome Big Grin

Please note i just edited my post to include another dead link that needs updating, specifically this one.
I'm a XBMC novice :)
Reply
#13
Thanks. That'll teach me to clean things up... I didn't want 20 different threads floating around the forum about the same thing so decided to start merging. Missed a couple!!
My Signature
Links to : Official:Forum rules (wiki) | Official:Forum rules/Banned add-ons (wiki) | Debug Log (wiki)
Links to : HOW-TO:Create Music Library (wiki) | HOW-TO:Create_Video_Library (wiki)  ||  Artwork (wiki) | Basic controls (wiki) | Import-export library (wiki) | Movie sets (wiki) | Movie universe (wiki) | NFO files (wiki) | Quick start guide (wiki)
Reply
#14
Rofl

Nothing wrong with a single post threads under various forums with one answer pointing to a main thread in an appropriate forum to discussing the issue in depth.
After all it makes it easier for people to find 'the one and only thread' that contains that main discussion.

Your achieved just that and 2/20 isn't too bad a hit rate Tongue
Thanks for your efforts Nod
I'm a XBMC novice :)
Reply
#15
Hi! I just wanted to say that I think having security fixes only for the latest release might not be the best course of action.

I understand not updating old releases with new features, totally. But not having security fixes risks leaving many, many people exposed for a variety of reasons.

I hope this decision can be changed. Thanks.

PS: I don't know how "easy" fix's implementation would be for previous releases.
For troubleshooting and bug reporting please make sure you read this first (usually it's enough to follow instructions in the second post).
Reply

Logout Mark Read Team Forum Stats Members Help
Latest Subtitle VNC hack0