Heap-based buffer overflow in msadpcm.c in libaudiofile in audiofile 0.2.6 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WAV file.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - audiofile: heap-based overflow in Microsoft ADPCM compression module (app crash, arb. code execution)     (CVE-2008-5824)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - audiofile: Heap-based buffer overflow in Expand3To4Module::run() when running sfconvert (CVE-2018-17095)

  - Heap-based buffer overflow in msadpcm.c in libaudiofile in audiofile 0.2.6 allows context-dependent     attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a     crafted WAV file. (CVE-2008-5824)

  - Buffer overflow in the afReadFrames function in audiofile (aka libaudiofile and Audio File Library) allows     user-assisted remote attackers to cause a denial of service (program crash) or possibly execute arbitrary     code via a crafted audio file, as demonstrated by sixteen-stereo-to-eight-mono.c. (CVE-2015-7747)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - audiofile: Heap-based buffer overflow in Expand3To4Module::run() when running sfconvert (CVE-2018-17095)

  - Heap-based buffer overflow in msadpcm.c in libaudiofile in audiofile 0.2.6 allows context-dependent     attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a     crafted WAV file. (CVE-2008-5824)

  - Heap-based buffer overflow in the MSADPCM::initializeCoefficients function in MSADPCM.cpp in audiofile     (aka libaudiofile and Audio File Library) 0.3.6 allows remote attackers to have unspecified impact via a     crafted audio file. (CVE-2017-6827)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

A heap-overflow in libaudiofile was fixed. The overflow existsed in the WAV processing code and can be exploited to execute arbitrary code.

This update also contains fixed audiofile-32bit packages.

It was discovered that Audio File Library contained a heap-based buffer overflow. If a user or automated system processed a crafted WAV file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. The default compiler options for Ubuntu should reduce this vulnerability to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Max Kellermann discovered a heap-based buffer overflow in the handling of ADPCM WAV files in libaudiofile. This flaw could result in a denial of service (application crash) or possibly execution of arbitrary code via a crafted WAV file.

The old stable distribution (etch), this problem will be fixed in version 0.2.6-6+etch1.

The packages for the oldstable distribution are not included in this advisory. An update will be released soon.

A heap-overflow in libaudiofile was fixed. The overflow existsed in the WAV processing code and can be exploited to execute arbitrary code. (CVE-2008-5824)

A heap-overflow in libaudiofile was fixed. The overflow existed in the WAV processing code and can be exploited to execute arbitrary code.
(CVE-2008-5824)

ID	Name	Product	Family	Severity
199409	RHEL 4 : audiofile (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199327	RHEL 5 : audiofile (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199316	RHEL 6 : audiofile (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
57159	SuSE 10 Security Update : audiofile (ZYPP Patch Number 7394)	Nessus	SuSE Local Security Checks	medium
53233	SuSE 10 Security Update : audiofile (ZYPP Patch Number 7315)	Nessus	SuSE Local Security Checks	medium
45079	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : audiofile vulnerability (USN-912-1)	Nessus	Ubuntu Local Security Checks	medium
44837	Debian DSA-1972-1 : audiofile - buffer overflow	Nessus	Debian Local Security Checks	medium
41478	SuSE 10 Security Update : audiofile (ZYPP Patch Number 5948)	Nessus	SuSE Local Security Checks	medium
41272	SuSE9 Security Update : audiofile (YOU Patch Number 12342)	Nessus	SuSE Local Security Checks	medium
40191	openSUSE Security Update : audiofile (audiofile-457)	Nessus	SuSE Local Security Checks	medium
39918	openSUSE Security Update : audiofile (audiofile-457)	Nessus	SuSE Local Security Checks	medium
35470	openSUSE 10 Security Update : audiofile (audiofile-5950)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2008-5824

critical

Tenable Plugins

critical

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium