oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a WAV file with the number of channels set to zero.

vorbis-tools is vulnerable to multiple issues that can result in denial of service.

CVE-2014-9638

Divide by zero error in oggenc with a WAV file whose number of channels is set to zero.

CVE-2014-9639

Integer overflow in oggenc via a crafted number of channels in a WAV file, which triggers an out-of-bounds memory access.

CVE-2014-9640

Out-of bounds read in oggenc via a crafted raw file.

CVE-2015-6749

Buffer overflow in the aiff_open function in oggenc/audio.c via a crafted AIFF file.

For Debian 7 'Wheezy', these problems have been fixed in version 1.4.0-1+deb7u1.

We recommend that you upgrade your vorbis-tools packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

vorbis-tools was updated to fix several security issues.

  - A buffer overflow in aiff_open() that could be triggered     by opening prepared malicious files (CVE-2015-6749,     bsc#943795).

  - A division by zero and integer overflow by crafted WAV     files was fixed (CVE-2014-9638, CVE-2014-9639,     bnc#914439, bnc#914441).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Various issues have been fixed in Debian LTS (squeeze) for package vorbis-tools.

CVE-2014-9638

A crafted WAV file with number of channels set to 0 will cause oggenc to crash due to a division by zero issue. This issue has been fixed upstream by providing a fix for CVE-2014-9639. Reported upstream by 'zuBux'.

CVE-2014-9639

An integer overflow issue was discovered in oggenc, related to the number of channels in the input WAV file. The issue triggers an out-of-bounds memory access which causes oggenc to crash here (audio.c). Reported upstream by 'zuBux'.

The upstream fix for this has been backported to vorbis-tools in Debian LTS (squeeze).

CVE-2014-9640

Fix for a crash on closing raw input (dd if=/dev/zero bs=1 count=1 | oggenc -r - -o out.ogg). Reported upstream by 'hanno'.

The upstream fix for this has been backported to vorbis-tools in Debian LTS (squeeze).

CVE-2015-6749

Buffer overflow in the aiff_open function in oggenc/audio.c in vorbis-tools 1.4.0 and earlier allowed remote attackers to cause a denial of service (crash) via a crafted AIFF file. Reported upstream by 'pengsu'.

The upstream fix for this has been backported to vorbis-tools in Debian LTS (squeeze).

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Paris Zoumpouloglou reports :

I discovered an integer overflow issue in oggenc, related to the number of channels in the input WAV file. The issue triggers an out-of-bounds memory access which causes oggenc to crash.

Paris Zoumpouloglou reports :

A crafted WAV file with number of channels set to 0 will cause oggenc to crash due to a division by zero issue.

pengsu reports :

I discovered an buffer overflow issue in oggenc/audio.c when it tries to open invalid aiff file.

Vorbis tools was updated to fix division by zero and integer overflows by crafted WAV files (CVE-2014-9638, CVE-2014-9639, bnc#914439, bnc#914441), that would allow attackers to crash the vorbis tools processes.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

vorbis-tools was updated to fix division by zero and integer overflow by crafted WAV files (CVE-2014-9638, CVE-2014-9639, bnc#914439, bnc#914441).

- validate count of channels in the header (CVE-2014-9638     and CVE-2014-9639)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
101209	Debian DLA-1010-1 : vorbis-tools security update	Nessus	Debian Local Security Checks	medium
86464	SUSE SLED11 Security Update : vorbis-tools (SUSE-SU-2015:1775-1)	Nessus	SuSE Local Security Checks	medium
86196	Debian DLA-317-1 : vorbis-tools security update	Nessus	Debian Local Security Checks	medium
85893	FreeBSD : vorbis-tools, opus-tools -- multiple vulnerabilities (a35f415d-572a-11e5-b0a4-f8b156b6dcc8)	Nessus	FreeBSD Local Security Checks	medium
84080	SUSE SLED12 / SLES12 Security Update : vorbis-tools (SUSE-SU-2015:1014-1)	Nessus	SuSE Local Security Checks	medium
81945	openSUSE Security Update : vorbis-tools (openSUSE-2015-239)	Nessus	SuSE Local Security Checks	medium
81586	Fedora 21 : vorbis-tools-1.4.0-19.fc21 (2015-2335)	Nessus	Fedora Local Security Checks	medium
81585	Fedora 20 : vorbis-tools-1.4.0-14.fc20 (2015-2330)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2014-9638

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium