SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Multimedia)  >   Network Audio System Vendors:   radscan.com
Network Audio System Bugs Let Remote Users Deny Service or Execute Arbitrary Code
SecurityTracker Alert ID:  1017822
SecurityTracker URL:  http://securitytracker.com/id/1017822
CVE Reference:   CVE-2007-1543, CVE-2007-1544, CVE-2007-1545, CVE-2007-1546, CVE-2007-1547   (Links to External Site)
Date:  Mar 28 2007
Impact:   Denial of service via network, Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 1.8a and prior versions
Description:   A vulnerability was reported in Network Audio System. A remote user can execute arbitrary code on the target system. A remote user can cause denial of service conditions.

A remote user can send specially crafted data to cause denial of service conditions or potentially execute arbitrary code on the target system. The code will run with the privileges of the target service.

The accept_att_local() function in 'server/os/connection.c' contains a stack overflow in the processing of slave name paths in a USL socket connection [CVE-2007-1543]

The ProcAuWriteElement() function in 'server/dia/audispatch.c' contains an integer overflow in the processing of the 'max_samples' parameter [CVE-2007-1544].

The AddResource() function in 'server/dia/resource.c' does not properly validate client ID values [CVE-2007-1545]. An invalid client ID value can cause the service to crash.

The ProcAuSetElements() function in 'server/dia/audispatch.c' does not properly validate the num_action parameter and the compileInputs() function in 'server/dia/auutil.c' does not properly validate the 'inputNum' parameter, allowing remote denial of service attacks [CVE-2007-1546].

The ReadRequestFromClient() function in 'server/os/io.c' lets remote users trigger a NULL pointer dereference to crash the service via multiple simultaneous connections [CVE-2007-1547].

Luigi Auriemma discovered these vulnerabilities.

The original advisory is available at:

http://aluigi.altervista.org/adv/nasbugs-adv.txt

Impact:   A remote user can execute arbitrary code on the target system.

A remote user can cause denial of service conditions.

Solution:   The vendor has issued a fixed version (1.8b development), available at:

http://www.radscan.com/nas.html

Vendor URL:  www.radscan.com/nas.html (Links to External Site)
Cause:   Boundary error, State error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC