Security News -  Security Reviews -   Exploits -  Tools -  UNIX Focus -  Windows Focus
SecuriTeam  Beyond Security  SecuriTeam Home  Ask the Team  Mailing Lists  Advertising Info  Blogs  Black Box Testing  Vulnerability Assessment  Vulnerability Scanner SecuriTeam in Your Inbox   E-mail this article to a friend New vulnerability? New tool? Tell us	SoX Local Buffer Overflow Vulnerabilities (st_wavstartread) 29 Jul. 2004    Summary SoX is a command line utility that converts various formats of computer audio files to other formats. SoX is vulnerable to a buffer overflow attack when processing WAV files. The condition occurs due to a user controlled length variable which is used to copy data to a local buffer without any bounds checking.   Credit: This information has been provided by Ulf Harnhammar    Details Protect your website! Use an External Vulnerability Scanner! Nothing to install. First report in 1 hour! www.beyondsecurity.com/vulnerability-scanner Vulnerable Systems:  * SoX versions 12.17.4, 12.17.3, 12.17.2 Immune Systems:  * SoX versions 12.17.1, 12.17, 12.16 Impact: Successful exploitation of this vulnerability allows an attacker to execute arbitrary code Technical details: Both overflows occur in wav.c in the function st_wavstartread(). In both cases, the program first reads 4 bytes from the .WAV file into a variable. Then it reads as many bytes as that variable says from the .WAV file into a 256 bytes long char array, without checking if the data from the .WAV file fits in that array. This leads to a stack-based buffer overflow with control over EIP, as you can see in this session capture: $ play buffy.wav playing buffy.wav /usr/bin/play: line 1: 4990 Segmentation fault sox $volume $fopts $fopts2 "$filename_0" $arch_defines $device $effects $ sox buffy.wav -t ossdsp /dev/dsp Segmentation fault $ gdb /usr/bin/sox GNU gdb 6.1-debian Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-linux"......Using host libthread_db library "/lib/libthread_db.so.1". (gdb) r buffy.wav -t ossdsp /dev/dsp Starting program: /usr/bin/sox buffy.wav -t ossdsp /dev/dsp Program received signal SIGSEGV, Segmentation fault. 0x55555555 in ?? () (gdb) i r eax 0x0 0 ecx 0x0 0 edx 0x0 0 ebx 0x55555555 1431655765 esp 0xbffff940 0xbffff940 ebp 0x55555555 0x55555555 esi 0x55555555 1431655765 edi 0x55555555 1431655765 eip 0x55555555 0x55555555 eflags 0x10282 66178 cs 0x23 35 ss 0x2b 43 ds 0x2b 43 es 0x2b 43 fs 0x0 0 gs 0x0 0 (gdb) bt #0 0x55555555 in ?? () #1 0x55555555 in ?? () #2 0x55555555 in ?? () #3 0x55555555 in ?? () #4 0x55555555 in ?? () #5 0x55555555 in ?? () #6 0x55555555 in ?? () #7 0xbffff900 in ?? () #8 0x08072fa2 in _IO_stdin_used () #9 0x00008572 in ?? () #10 0x45564157 in ?? () #11 0x002a5550 in ?? () #12 0x0807d0b8 in ?? () #13 0x0807d3c4 in ?? () #14 0x080a4400 in ?? () #15 0xbffff9a8 in ?? () #16 0x0804c9b7 in ?? () #17 0x08072f56 in _IO_stdin_used () #18 0xbffffb74 in ?? () #19 0x00000000 in ?? () #20 0x00000000 in ?? () #21 0x080a4400 in ?? () #22 0x00000005 in ?? () #23 0xbffff9c8 in ?? () #24 0x0804ad4b in ?? () #25 0x080a3cd8 in ?? () #26 0x00000001 in ?? () #27 0xbffff9c8 in ?? () #28 0x0804a42b in ?? () #29 0x080a4400 in ?? () #30 0x000005b4 in ?? () #31 0x76000001 in ?? () #32 0x00000005 in ?? () #33 0x080a4400 in ?? () #34 0x00000005 in ?? () #35 0xbffff9f8 in ?? () #36 0x0804a08b in ?? () #37 0x080a4400 in ?? () #38 0x00000005 in ?? () #39 0xbffffa54 in ?? () #40 0x080725bb in ?? () #41 0x402a5550 in ?? () from /lib/libc.so.6 #42 0x08072600 in ?? () #43 0x00000001 in ?? () #44 0x402a5550 in ?? () from /lib/libc.so.6 #45 0x400164a0 in ?? () from /lib/ld-linux.so.2 #46 0xbffffa54 in ?? () #47 0xbffffa28 in ?? () #48 0x4018bdc6 in __libc_start_main () from /lib/libc.so.6 Previous frame inner to this frame (corrupt stack?) (gdb) q The program is running. Exit anyway? (y or n) y $  Comments:  Add new comment:  Subject:  Name/Nick/Email:          Chars Left:	All Sections Security News Unix focus Exploits Tools Windows focus Security Reviews  Related Articles Apple WebKit attr() Invalid Attribute Memory Corruption Vulnerability Pivot Cross Site Scripting and HTML Injection IBM AIX ToolTalk Database Server Buffer Overflow Vulnerability Webmedia Explorer Cross Site Scripting Vulnerability phpMyAdmin Code Injection Pantha transLucid Cross Site Scripting and HTML Injection Vulnerabilities Clam AntiVIrus Generic Bypass Using RAR CAB or ZIP Files Apache Tomcat RequestDispatcher Directory Traversal Vulnerability HP-UX Running OpenSSL DoS Joomla JA_Purity Multiple Persistent XSS Drupal Flag Module Multiple Vulnerabilities Apple Terminal xterm Resize Escape Sequence Memory Corruption Vulnerability Apple CUPS NULL Pointer Vulnerability OCS Inventory NG Multiple SQL Injections HP-UX Execution of Arbitrary Code and Other Vulnerabilities  Featured Articles Adobe Shockwave Player Director File Parsing Pointer Overwrite Mozilla Firefox Java Applet Loading Vulnerability Microsoft Internet Explorer Security Zone Restrictions Bypass Adobe Acrobat and Reader Heap Overflow Vulnerability Adobe Reader U3D Stack Overflow Vulnerability Apple CUPS NULL Pointer Vulnerability SonicWALL Global Security Client Privilege Escalation Vulnerability
	Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus - Blogs - CVEs

Copyright © 1998-2008 Beyond Security® All rights reserved.
Terms of Use Site Privacy Statement.
SecuriTeam™ is a trademark of Beyond Security®