Integer overflow in the ProcAuWriteElement function in server/dia/audispatch.c in Network Audio System (NAS) before 1.8a SVN 237 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large max_samples value.

Luigi Auriemma discovered multiple flaws in the Network Audio System server. Remote attackers could send specially crafted network requests that could lead to a denial of service or execution of arbitrary code.
Note that default Ubuntu installs do not include the NAS server.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200704-20 (NAS: Multiple vulnerabilities)

    Luigi Auriemma has discovered multiple vulnerabilities in NAS, some of     which include a buffer overflow in the function accept_att_local(), an     integer overflow in the function ProcAuWriteElement(), and a null     pointer error in the function ReadRequestFromClient().
  Impact :

    An attacker having access to the NAS daemon could send an overly long     slave name to the server, leading to the execution of arbitrary code     with root privileges. A remote attacker could also send a specially     crafted packet containing an invalid client ID, which would crash the     server and result in a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in nas, the Network Audio System.

  - CVE-2007-1543     A stack-based buffer overflow in the accept_att_local     function in server/os/connection.c in nas allows remote     attackers to execute arbitrary code via a long path     slave name in a USL socket connection.

  - CVE-2007-1544     An integer overflow in the ProcAuWriteElement function     in server/dia/audispatch.c allows remote attackers to     cause a denial of service (crash) and possibly execute     arbitrary code via a large max_samples value.

  - CVE-2007-1545     The AddResource function in server/dia/resource.c allows     remote attackers to cause a denial of service (server     crash) via a nonexistent client ID.

  - CVE-2007-1546     An array index error allows remote attackers to cause a     denial of service (crash) via (1) large num_action     values in the ProcAuSetElements function in     server/dia/audispatch.c or (2) a large inputNum     parameter to the compileInputs function in     server/dia/auutil.c.

  - CVE-2007-1547     The ReadRequestFromClient function in server/os/io.c     allows remote attackers to cause a denial of service     (crash) via multiple simultaneous connections, which     triggers a NULL pointer dereference.

Luigi Auriemma discovered a number of problems with the nas (Network Audio System) daemon that could be used to crash nasd.

Updated packages have been patched to address this issue.

ID	Name	Product	Family	Severity
28043	Ubuntu 5.10 / 6.06 LTS / 6.10 : nas vulnerabilities (USN-446-1)	Nessus	Ubuntu Local Security Checks	critical
25108	GLSA-200704-20 : NAS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
24921	Debian DSA-1273-1 : nas - several vulnerabilities	Nessus	Debian Local Security Checks	critical
24891	Mandrake Linux Security Advisory : nas (MDKSA-2007:065)	Nessus	Mandriva Local Security Checks	critical

Detections

Analytics

CVE-2007-1544

critical

Tenable Plugins

critical

critical

critical

critical