Executive Summary

Summary
Title libsndfile: User-assisted execution of arbitrary code
Informations
Name GLSA-200905-09 First vendor Publication 2009-05-27
Vendor Gentoo Last vendor Modification 2009-05-27
Severity (Vendor) Normal Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 9.3 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

Multiple heap-based buffer overflow vulnerabilities in libsndfile might allow remote attackers to execute arbitrary code.

Background

libsndfile is a C library for reading and writing files containing sampled sound.

Description

The following vulnerabilities have been found in libsndfile:

* Tobias Klein reported that the header_read() function in src/common.c uses user input for calculating a buffer size, possibly leading to a heap-based buffer overflow (CVE-2009-1788).

* The vendor reported a boundary error in the aiff_read_header()
function in src/aiff.c, possibly leading to a heap-based buffer overflow (CVE-2009-1791).

Impact

A remote attacker could entice a user to open a specially crafted AIFF or VOC file in a program using libsndfile, possibly resulting in the execution of arbitrary code with the privileges of the user running the application.

Workaround

There is no known workaround at this time.

Resolution

All libsndfile users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/libsndfile-1.0.20"

References

[ 1 ] CVE-2009-1788 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1788
[ 2 ] CVE-2009-1791 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1791

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200905-09.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-200905-09.xml

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:13539
 
Oval ID: oval:org.mitre.oval:def:13539
Title: DSA-1814-1 libsndfile -- heap-based buffer overflow
Description: Two vulnerabilities have been found in libsndfile, a library to read and write sampled audio data. The Common Vulnerabilities and Exposures project identified the following problems: Tobias Klein discovered that the VOC parsing routines suffer of a heap-based buffer overflow which can be triggered by an attacker via a crafted VOC header. The vendor discovered that the AIFF parsing routines suffer of a heap-based buffer overflow similar to CVE-2009-1788 which can be triggered by an attacker via a crafted AIFF header. In both cases the overflowing data is not completely attacker controlled but still leads to application crashes or under some circumstances might still lead to arbitrary code execution. For the oldstable distribution, this problem has been fixed in version 1.0.16-2+etch2. For the stable distribution, this problem has been fixed in version 1.0.17-4+lenny2. For the testing distribution, this problem will be fixed soon. For the unstable distribution, this problem has been fixed in version 1.0.20-1. We recommend that you upgrade your libsndfile packages.
Family: unix Class: patch
Reference(s): DSA-1814-1
CVE-2009-1788
CVE-2009-1791
 Version: 5
Platform(s): Debian GNU/Linux 5.0
Debian GNU/Linux 4.0
 Product(s): libsndfile
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13768
 
Oval ID: oval:org.mitre.oval:def:13768
Title: USN-849-1 -- libsndfile vulnerabilities
Description: Tobias Klein discovered a heap-based buffer overflow in libsndfile. If a user or automated system processed a crafted VOC file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. Erik de Castro Lopo discovered a similar heap-based buffer overflow when processing AIFF files. If a user or automated system processed a crafted AIFF file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program
Family: unix Class: patch
Reference(s): USN-849-1
CVE-2009-1788
CVE-2009-1791
 Version: 5
Platform(s): Ubuntu 8.10
Ubuntu 8.04
Ubuntu 9.04
 Product(s): libsndfile
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26281
 
Oval ID: oval:org.mitre.oval:def:26281
Title: Heap-based buffer overflow in aiff_read_header in libsndfile 1.0.15 through 1.0.19 in Winamp 5.552
Description: Heap-based buffer overflow in aiff_read_header in libsndfile 1.0.15 through 1.0.19, as used in Winamp 5.552 and possibly other media programs, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an AIFF file with an invalid header value.
Family: windows Class: vulnerability
Reference(s): CVE-2009-1791
 Version: 4
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Vista
Microsoft Windows Server 2008
Microsoft Windows 7
Microsoft Windows Server 2008 R2
Microsoft Windows 8
Microsoft Windows Server 2012
Microsoft Windows 8.1
Microsoft Windows Server 2012 R2
 Product(s): Winamp
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26385
 
Oval ID: oval:org.mitre.oval:def:26385
Title: Heap-based buffer overflow in voc_read_header in libsndfile 1.0.15 through 1.0.19 in Winamp 5.552
Description: Heap-based buffer overflow in voc_read_header in libsndfile 1.0.15 through 1.0.19, as used in Winamp 5.552 and possibly other media programs, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a VOC file with an invalid header value.
Family: windows Class: vulnerability
Reference(s): CVE-2009-1788
 Version: 4
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Vista
Microsoft Windows Server 2008
Microsoft Windows 7
Microsoft Windows Server 2008 R2
Microsoft Windows 8
Microsoft Windows Server 2012
Microsoft Windows 8.1
Microsoft Windows Server 2012 R2
 Product(s): Winamp
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7997
 
Oval ID: oval:org.mitre.oval:def:7997
Title: DSA-1814 libsndfile -- heap-based buffer overflow
Description: Two vulnerabilities have been found in libsndfile, a library to read and write sampled audio data. The Common Vulnerabilities and Exposures project identified the following problems: Tobias Klein discovered that the VOC parsing routines suffer of a heap-based buffer overflow which can be triggered by an attacker via a crafted VOC header. The vendor discovered that the AIFF parsing routines suffer of a heap-based buffer overflow similar to CVE-2009-1788 which can be triggered by an attacker via a crafted AIFF header. In both cases the overflowing data is not completely attacker controlled but still leads to application crashes or under some circumstances might still lead to arbitrary code execution.
Family: unix Class: patch
Reference(s): DSA-1814
CVE-2009-1788
CVE-2009-1791
 Version: 3
Platform(s): Debian GNU/Linux 5.0
Debian GNU/Linux 4.0
 Product(s): libsndfile
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 5
Application 7

OpenVAS Exploits

Date Description
2009-12-10 Name : Fedora Core 10 FEDORA-2009-11499 (libsndfile)
File : nvt/fcore_2009_11499.nasl
2009-12-10 Name : Fedora Core 11 FEDORA-2009-11618 (libsndfile)
File : nvt/fcore_2009_11618.nasl
2009-12-10 Name : Mandriva Security Advisory MDVSA-2009:132-1 (libsndfile)
File : nvt/mdksa_2009_132_1.nasl
2009-10-11 Name : SLES11: Security update for libsndfile
File : nvt/sles11_libsndfile0.nasl
2009-08-17 Name : SuSE Security Summary SUSE-SR:2009:013
File : nvt/suse_sr_2009_013.nasl
2009-06-23 Name : Debian Security Advisory DSA 1814-1 (libsndfile)
File : nvt/deb_1814_1.nasl
2009-06-09 Name : Mandrake Security Advisory MDVSA-2009:132 (libsndfile)
File : nvt/mdksa_2009_132.nasl
2009-06-05 Name : FreeBSD Ports: libsndfile
File : nvt/freebsd_libsndfile0.nasl
2009-06-05 Name : Gentoo Security Advisory GLSA 200905-09 (libsndfile)
File : nvt/glsa_200905_09.nasl
2009-06-04 Name : Winamp libsndfile Buffer Overflow Vulnerability
File : nvt/secpod_winamp_libsndfile_bof_vuln.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
54511 libsndfile src/aiff.c aiff_read_header() Function Overflow
54510 libsndfile src/voc.c voc_read_header() Function Overflow

Nessus® Vulnerability Scanner

Date Description
2009-12-03 Name : The remote Fedora host is missing a security update.
File : fedora_2009-11499.nasl - Type : ACT_GATHER_INFO
2009-12-03 Name : The remote Fedora host is missing a security update.
File : fedora_2009-11618.nasl - Type : ACT_GATHER_INFO
2009-10-16 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-849-1.nasl - Type : ACT_GATHER_INFO
2009-10-06 Name : The remote openSUSE host is missing a security update.
File : suse_libsndfile-6277.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_libsndfile-090528.nasl - Type : ACT_GATHER_INFO
2009-07-22 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_libsndfile-090528.nasl - Type : ACT_GATHER_INFO
2009-07-22 Name : The remote openSUSE host is missing a security update.
File : suse_11_1_libsndfile-090528.nasl - Type : ACT_GATHER_INFO
2009-06-15 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1814.nasl - Type : ACT_GATHER_INFO
2009-06-08 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-132.nasl - Type : ACT_GATHER_INFO
2009-06-01 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_6355efdb4d4d11de88110030843d3802.nasl - Type : ACT_GATHER_INFO
2009-05-28 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200905-09.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:36:33
  • Multiple Updates