Network Audio System Bugs Let Remote Users Deny Service or Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1017822
|
|
SecurityTracker URL: http://securitytracker.com/id?1017822
|
|
CVE Reference: CVE-2007-1543
, CVE-2007-1544
, CVE-2007-1545
, CVE-2007-1546
, CVE-2007-1547
(Links to External Site)
|
Date: Mar 28 2007
|
Impact: Denial of service via network, Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): 1.8a and prior versions
|
Description: A vulnerability was reported in Network Audio System. A remote user can execute arbitrary code on the target system. A remote user can cause denial of service conditions.
A remote user can send specially crafted data to cause denial of service conditions or potentially execute arbitrary code on the
target system. The code will run with the privileges of the target service.
The accept_att_local() function in 'server/os/connection.c'
contains a stack overflow in the processing of slave name paths in a USL socket connection [CVE-2007-1543]
The ProcAuWriteElement()
function in 'server/dia/audispatch.c' contains an integer overflow in the processing of the 'max_samples' parameter [CVE-2007-1544].
The
AddResource() function in 'server/dia/resource.c' does not properly validate client ID values [CVE-2007-1545]. An invalid client
ID value can cause the service to crash.
The ProcAuSetElements() function in 'server/dia/audispatch.c' does not properly validate
the num_action parameter and the compileInputs() function in 'server/dia/auutil.c' does not properly validate the 'inputNum' parameter,
allowing remote denial of service attacks [CVE-2007-1546].
The ReadRequestFromClient() function in 'server/os/io.c' lets remote
users trigger a NULL pointer dereference to crash the service via multiple simultaneous connections [CVE-2007-1547].
Luigi Auriemma
discovered these vulnerabilities.
The original advisory is available at:
http://aluigi.altervista.org/adv/nasbugs-adv.txt
|
Impact: A remote user can execute arbitrary code on the target system.
A remote user can cause denial of service conditions.
|
Solution: The vendor has issued a fixed version (1.8b development), available at:
http://www.radscan.com/nas.html
|
Vendor URL: www.radscan.com/nas.html (Links to External Site)
|
Cause: Boundary error, State error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 28 Mar 2007 00:49:59 -0500
Subject: Network Audio System
|
> Multiple vulnerabilities in NAS 1.8a (svn 231)
http://aluigi.altervista.org/adv/nasbugs-adv.txt
CVE-2007-1543
CVE-2007-1544
CVE-2007-1545
CVE-2007-1546
CVE-2007-1547
|
|
