Amazon Linux 2 : sox, --advisory ALAS2-2023-2231 (ALAS-2023-2231)

critical Nessus Plugin ID 181164

Language:

Synopsis

The remote Amazon Linux 2 host is missing a security update.

Description

The version of sox installed on the remote host is prior to 14.4.1-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2231 advisory.

A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function lsx_read_w_buf() in formats_i.c file. The vulnerability is exploitable with a crafted file, that could cause an application to crash. (CVE-2021-23159)

A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function startread() in hcom.c file. The vulnerability is exploitable with a crafted hcomn file, that could cause an application to crash. (CVE-2021-23172)

A flaw was found in sox 14.4.1. The lsx_adpcm_init function within libsox leads to a global-buffer- overflow. This flaw allows an attacker to input a malicious file, leading to the disclosure of sensitive information. (CVE-2021-3643)

In SoX 14.4.2, there is a floating-point exception in lsx_aiffstartwrite in aiff.c in libsox.a.
(CVE-2022-31650)

In SoX 14.4.2, there is an assertion failure in rate_init in rate.c in libsox.a. (CVE-2022-31651)

A vulnerabilty was found in sox v14.4.3, Floating Point Exception vulnerability that exists in the lsx_aiffstartwrite function at sox/src/aiff.c:622:58. This vulnerability could lead to security issues such as denial of service. (CVE-2023-26590)

A vulnerabilty was found in sox v14.4.3, where floating point exception vulnerability that exists in the read_samples function at sox/src/voc.c:334:18. This vulnerability could lead to security issues such as denial of service. (CVE-2023-32627)

A vulnerabilty was found in sox v14.4.3, heap-buffer-overflow vulnerability that exists in the startread function at sox/src/hcom.c:160:41. This vulnerability could lead to security issues such as denial of service, code execution, or information disclosure (CVE-2023-34318)

A vulnerabilty was found in sox v14.4.3, heap-buffer-overflow vulnerability that exists in the lsx_readbuf function at sox/src/formats_i.c:98:16. This vulnerability could lead to security issues such as denial of service, code execution, or information disclosure. (CVE-2023-34432)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'yum update sox' or or 'yum update --advisory ALAS2-2023-2231' to update your system.

Plugin Details

Severity: Critical

ID: 181164

File Name: al2_ALAS-2023-2231.nasl

Version: 1.6

Type: local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 9/8/2023

Updated: 10/8/2025

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P

CVSS Score Source: CVE-2021-3643

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:amazon:linux:2, p-cpe:/a:amazon:linux:sox-debuginfo, p-cpe:/a:amazon:linux:sox-devel, p-cpe:/a:amazon:linux:sox

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/31/2023

Vulnerability Publication Date: 5/2/2022

Reference Information

CVE: CVE-2021-23159, CVE-2021-23172, CVE-2021-3643, CVE-2022-31650, CVE-2022-31651, CVE-2023-26590, CVE-2023-32627, CVE-2023-34318, CVE-2023-34432

Detections

Analytics