Heap-based buffer overflow in the flac_buffer_copy function in libsndfile 1.0.17 and earlier might allow remote attackers to execute arbitrary code via a FLAC file with crafted PCM data containing a block with a size that exceeds the previous block size.

This update fixes a possible buffer overflow that occurs while reading decoded PCM data from the FLAC library. (CVE-2007-4974)

Rubert Buchholz discovered that libsndfile, a library for reading / writing audio files, performs insufficient boundary checks when processing FLAC files, which might lead to the execution of arbitrary code.

Robert Buchholz discovered that libsndfile did not correctly validate the size of its memory buffers. If a user were tricked into playing a specially crafted FLAC file, a remote attacker could execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated libsndfile package has been released, fixing a potential heap-based buffer overflow in malcrafted flac files.

Thx to Robert Buchholz for finding that issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200710-04 (libsndfile: Buffer overflow)

    Robert Buchholz of the Gentoo Security team discovered that the     flac_buffer_copy() function does not correctly handle FLAC streams with     variable block sizes which leads to a heap-based buffer overflow     (CVE-2007-4974).
  Impact :

    A remote attacker could exploit this vulnerability by enticing a user     to open a specially crafted FLAC file or network stream with an     application using libsndfile. This might lead to the execution of     arbitrary code with privileges of the user playing the file.
  Workaround :

    There is no known workaround at this time.

A heap-based buffer overflow in libsndfile could allow remote attackers to execute arbitrary code via a FLAC file with crafted PCM data which contains a block with a size exceeding that of the previous block.

Updated packages have been patched to prevent this issue.

ID	Name	Product	Family	Severity
29881	openSUSE 10 Security Update : libsndfile (libsndfile-4430)	Nessus	SuSE Local Security Checks	high
29851	SuSE 10 Security Update : libsndfile (ZYPP Patch Number 4431)	Nessus	SuSE Local Security Checks	high
29836	Debian DSA-1442-1 : libsndfile - buffer overflow	Nessus	Debian Local Security Checks	high
28130	Ubuntu 6.06 LTS / 6.10 / 7.04 : libsndfile vulnerability (USN-525-1)	Nessus	Ubuntu Local Security Checks	high
27762	Fedora 7 : libsndfile-1.0.17-2.fc7 (2007-2236)	Nessus	Fedora Local Security Checks	high
26944	GLSA-200710-04 : libsndfile: Buffer overflow	Nessus	Gentoo Local Security Checks	high
26901	Mandrake Linux Security Advisory : libsndfile (MDKSA-2007:191)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2007-4974

high

Tenable Plugins

high

high

high

high

high

high

high