|
Network Audio System Multiple Vulnerabilities
|
|
Secunia Advisory:
|
SA24527
|
|
|
Release Date:
|
2007-03-19
|
|
Last Update:
|
2007-04-09
|
|
Popularity:
|
5,858 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Privilege escalation
DoS
|
|
Where:
|
From local network
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Network Audio System 1.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2007-1543
CVE-2007-1544
CVE-2007-1545
CVE-2007-1546
CVE-2007-1547
|
|
Description:
Luigi Auriemma has reported some vulnerabilities in Network Audio System, which potentially can be exploited by malicious, local users to gain escalated privileges or by malicious people to cause a DoS (Denial of Service).
1) A boundary error within "accept_att_local()" in server/os/connection.c can be exploited to cause a stack-based buffer overflow via an overly long (greater than 64 bytes) slave name in a USL connection.
Successful exploitation may allow malicious, local users to gain root privileges.
2) An input validation error within "AddResource()" in server/dia/resource.c can be exploited to cause the service to crash via a specially crafted packet with an invalid client ID.
3) An integer-overflow error within "ProcAuWriteElement()" in server/dia/audispatch.c can be exploited to cause the service to crash via a specially crafted packet with an overly large max_samples value.
4) A boundary error within "ProcAuSetElements()" in server/dia/audispatch.c can be exploited to cause the service to crash via a specially crafted packet with an overly large num_actions or numElements value.
5) An input validation error within "compileInputs()" in server/dia/auutil.c can be exploited to cause the service to crash via a specially crafted packet with an invalid element number.
6) A NULL-pointer dereference error when processing simultaneous connections can be exploited to cause the service to crash.
The vulnerabilities are reported in version 1.8a. Other versions may also be affected.
Solution:
Update to version 1.9.
Provided and/or discovered by:
Luigi Auriemma
Changelog:
2007-03-26: Update "Solution" and "Solution Status" sections to include fix information. Added CVE references.
2007-04-09: Updated "Solution" section to include stable version.
Original Advisory:
http://aluigi.altervista.org/adv/nasbugs-adv.txt
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
