SoX WAV File Buffer Overflow Vulnerability

BID:10819

Info

SoX WAV File Buffer Overflow Vulnerability

Bugtraq ID: 10819
Class: Boundary Condition Error
CVE: CVE-2004-0557
Remote: No
Local: Yes
Published: Jul 28 2004 12:00AM
Updated: Aug 05 2010 07:45PM
Credit: This vulnerability was disclosed by Ulf Harnhammar.
Vulnerable: SoX SoX 12.17.4
SoX SoX 12.17.3
SoX SoX 12.17.2
SGI Advanced Linux Environment 3.0
Redhat Linux 9.0 i386
Redhat Linux 7.3 i386
Redhat Fedora Core2
Redhat Fedora Core1
Redhat Enterprise Linux WS 3
Redhat Enterprise Linux ES 3
Redhat Enterprise Linux AS 3
Redhat Desktop 3.0
Gentoo Linux 1.4
Not Vulnerable: SoX SoX 12.17.1
SoX SoX 12.17
SoX SoX 12.16

Discussion

SoX WAV File Buffer Overflow Vulnerability

The WAV header handling code in SoX is reported to contain a buffer overflow vulnerability. This issue is due to a failure of the application to validate string lengths when copying user-supplied data into finite buffers in process memory.

The attacker must be able to present a malicious WAV file to an unsuspecting user. The user must employ the affected application to either listen to, or process the malicious file.

Ultimately a malicious attacker may exploit this issue to execute arbitrary code on the affected computer with the privileges of the user who started the affected application.

Exploit / POC

Solution / Fix

SoX WAV File Buffer Overflow Vulnerability

Solution:
RedHat has released a Fedora Legacy advisory FLSA:1945 along with fixes for RedHat Linux. Please see the referenced advisory for more information.

Conectiva has released advisory CLA-2004:855 and updates to address this issue for Conectiva 8, 9 and 10. Please see the referenced advisory for further details regarding obtaining and applying appropriate updates.

RedHat Linux has released advisories FEDORA-2004-235, and FEDORA-2004-244. These advisories provide fixes and further information about the vulnerabilities for Fedora Core 1 and Fedora Core 2. Please see the referenced advisories.

Mandrake has released advisory MDKSA-2004:076 along with fixes dealing with this issue. Please see the referenced advisory for more information.

RedHat Linux has released advisory RHSA-2004:409-05 for RedHat Enterprise Linux products. Please see the referenced advisory for further information on obtaining fixes.

Gentoo Linux has released advisory GLSA 200407-23 to address this issue. Please see the referenced advisory for further information. Users of affected packages are urged to execute the following with superuser privileges:
emerge sync
emerge -pv ">=media-sound/sox-12.17.4-r2"
emerge ">=media-sound/sox-12.17.4-r2"

Slackware has released an advisory (SSA:2004-223-03) to address this issue. Please see the referenced advisory for more information.

SGI has made available Patch 10095, correcting this vulnerability for systems running SGI Advanced Linux Environment 3:

Patch 10095 is available from http://support.sgi.com/ and
ftp://patches.sgi.com/support/free/security/patches/ProPack/3/

The individual RPMs from Patch 10095 are available from:
ftp://oss.sgi.com/projects/sgi_propack/download/3/updates/RPMS
ftp://oss.sgi.com/projects/sgi_propack/download/3/updates/SRPMS

Debian Linux has released an advisory (DSA 565-1) along with fixes dealing with this issue. Please see the referenced advisory for more information.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.


SoX SoX 12.17.3

SoX SoX 12.17.4

References

SoX WAV File Buffer Overflow Vulnerability

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report