Multiple buffer overflows in the st_wavstartread function in wav.c for Sound eXchange (SoX) 12.17.2 through 12.17.4 allow remote attackers to execute arbitrary code via certain WAV file header fields.

Ulf Harnhammar discovered a pair of buffer overflows in the WAV file handling code of SoX. If an attacker can cause her victim to process a specially crafted WAV file with SoX (e.g. through social engineering or through some other program that relies on SoX), arbitrary code can be executed with the privileges of the victim.

Ulf Harnhammar has reported two vulnerabilities in SoX, a universal sound sample translator, which may be exploited by malicious people to compromise a user's system with a specially crafted .wav file.

The remote host is affected by the vulnerability described in GLSA-200407-23 (SoX: Multiple buffer overflows)

    Ulf Harnhammar discovered two buffer overflows in the sox and play     commands when handling WAV files with specially crafted header fields.
  Impact :

    By enticing a user to play or convert a specially crafted WAV file an     attacker could execute arbitrary code with the permissions of the user     running SoX.
  Workaround :

    There is no known workaround at this time. All users are encouraged to     upgrade to the latest available version of SoX.

Ulf Harnhammar discovered two buffer overflows in SoX. They occur when the sox or play commands handle malicious .WAV files.

Versions 12.17.4, 12.17.3 and 12.17.2 are vulnerable to these overflows. 12.17.1, 12.17 and 12.16 are some versions that are not.

Updated sox packages that fix buffer overflows in the WAV file handling code are now available.

SoX (Sound eXchange) is a sound file format converter. SoX can convert between many different digitized sound formats and perform simple sound manipulation functions, including sound effects.

Buffer overflows existed in the parsing of WAV file header fields. It was possible that a malicious WAV file could have caused arbitrary code to be executed when the file was played or converted. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0557 to these issues.

All users of sox should upgrade to these updated packages, which resolve these issues as well as fix a number of minor bugs.

Updated sox packages that fix buffer overflows in the WAV file handling code are now available. Buffer overflows existed in the parsing of WAV file header fields. It was possible that a malicious WAV file could have caused arbitrary code to be executed when the file was played or converted.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated sox packages that fix buffer overflows in the WAV file handling code are now available.

Buffer overflows existed in the parsing of WAV file header fields. It was possible that a malicious WAV file could have caused arbitrary code to be executed when the file was played or converted.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
36863	FreeBSD : SoX buffer overflows when handling .WAV files (3e4ffe76-e0d4-11d8-9b0a-000347a4fa7d)	Nessus	FreeBSD Local Security Checks	critical
15663	Debian DSA-565-1 : sox - buffer overflow	Nessus	Debian Local Security Checks	critical
14556	GLSA-200407-23 : SoX: Multiple buffer overflows	Nessus	Gentoo Local Security Checks	critical
14174	Mandrake Linux Security Advisory : sox (MDKSA-2004:076)	Nessus	Mandriva Local Security Checks	critical
13853	RHEL 3 : sox (RHSA-2004:409)	Nessus	Red Hat Local Security Checks	critical
13851	Fedora Core 2 : sox-12.17.4-4.fc2 (2004-244)	Nessus	Fedora Local Security Checks	critical
13850	Fedora Core 1 : sox-12.17.4-4.fc1 (2004-235)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2004-0557

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical