The answer to your question - is ffmpeg safe is -
Not really. There are security risks, especially if you allow arbitrary formats. FFmpeg supports a huge variety of formats, both popular and obscure, for video, audio, and images formats. Any vulnerability in decoders for any of the numerous formats could be exploited to gain arbitrary code execution. Now, this gets even more possible given the fact that FFmpeg is written in C, which is not memory safe and is optimised for speed instead of security. You must assume any untrusted input passed to FFmpeg can be used to gain full arbitrary code execution in the context of the running process and build your threat model around that.
There are a few things you can do to mitigate potential risks in addition to hardening Docker:
Seccomp sandboxing - Enable seccomp in Docker to limit the syscalls that can be made. A syscall, or system call, is the interface used by userspace to communicate with the kernel. Certain syscalls are complex and can be insecure, opening up bugs in the kernel to exploitation.
Formats/codecs - Disable unused decoders to reduce the attack surface area of the decoder. Many formats, or formats with obscure features, have low-quality decoders that are not regularly checked for bugs. While the Opus decoder is likely to be of acceptable quality, what about G.726?
Resource limits - Restrict resources that any given FFmpeg process can use. Resources can not only be used to DoS the system but can be necessary to exploit other vulnerabilities to elevate privileges, for example, certain kinds of integer overflow that require large memory allocations.
Mandatory Access Controls - Use a MAC like AppArmor or SELinux to restrict access and protect sensitive objects, even in the case of a Docker breakout. You can also use a MAC to limit network connections since there is no reason FFmpeg should upload or download data.
Compiler hardening - Use hardening when building FFmpeg, or download a hardened version. Compiler hardening like PIE, SSP, and FORTIFY_SOURCE can make vulnerabilities harder to exploit. PIE is especially important, as it allows the operating system to make full use of ASLR.
Is Ffmpeg safe or a Virus?
Let’s check the location of this exe file to determine whether this is a legit software or a virus. The location of this file and dangerous rating is File Location / Rating : C:
To check whether the exe file is legit you can start the Task Manager. Then click on the columns field and add Verified Signer as one of the columns. Now look at the Verified Signer value for ffmpeg.exe process if it says “Unable to verify” then the file may be a virus. File Name
ffmpeg.exe Software Developer
SARL ACLAP File Type
File Lo C:
Software Pazera Free
