Luigi Auriemma has reported some vulnerabilities in Network Audio System, which potentially can be exploited by malicious, local users to gain escalated privileges or by malicious people to cause a DoS (Denial of Service).

1) A boundary error within "accept_att_local()" in server/os/connection.c can be exploited to cause a stack-based buffer overflow via an overly long (greater than 64 bytes) slave name in a USL connection.

Successful exploitation may allow malicious, local users to gain root privileges.

2) An input validation error within "AddResource()" in server/dia/resource.c can be exploited to cause the service to crash via a specially crafted packet with an invalid client ID.

3) An integer-overflow error within "ProcAuWriteElement()" in server/dia/audispatch.c can be exploited to cause the service to crash via a specially crafted packet with an overly large max_samples value.

4) A boundary error within "ProcAuSetElements()" in server/dia/audispatch.c can be exploited to cause the service to crash via a specially crafted packet with an overly large num_actions or numElements value.

5) An input validation error within "compileInputs()" in server/dia/auutil.c can be exploited to cause the service to crash via a specially crafted packet with an invalid element number.

6) A NULL-pointer dereference error when processing simultaneous connections can be exploited to cause the service to crash.

The vulnerabilities are reported in version 1.8a. Other versions may also be affected.

Solution
Update to version 1.9.

Provided and/or discovered by
Luigi Auriemma

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://aluigi.altervista.org/adv/nasbugs-adv.txt

Deep Links
Links available to Secunia VIM customers