Heap-based buffer overflow in the GetWavHeader function in generic/jkSoundFile.c in the Snack Sound Toolkit, as used in WaveSurfer 1.8.8p4, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large chunk size in a WAV file.

This update for snack fixes the following issues :

Security issue fixed :

  - CVE-2012-6303: Heap-based buffer overflow in the     GetWavHeader function in generic/jkSoundFile.c in the     Snack Sound Toolkit, as used in WaveSurfer 1.8.8p4,     allows remote attackers to cause a denial of service     (crash) and possibly execute arbitrary code via a large     chunk size in a WAV file. (bnc#793860)

snack was updated to fix one security issue.

This security issue was fixed :

  - CVE-2012-6303: Heap-based buffer overflow in the     GetWavHeader function in generic/jkSoundFile.c in the     Snack Sound Toolkit, as used in WaveSurfer 1.8.8p4,     allowed remote attackers to cause a denial of service     (crash) and possibly execute arbitrary code via a large     chunk size in a WAV file (bnc#793860).

The remote host is affected by the vulnerability described in GLSA-201309-04 (Snack: User-assisted execution of arbitrary code)

    The GetWavHeader() function in jkSoundFile.c does not have boundary       checks when parsing format sub-chunks or unknown sub-chunks.
  Impact :

    A remote attacker could entice a user to open a specially crafted WAV       file with an application using Snack, possibly resulting in execution of       arbitrary code or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Updated snack packages fix security vulnerability :

Two vulnerabilities have been discovered in Snack Sound Toolkit, which are caused due to missing boundary checks in the GetWavHeader() function (generic/jkSoundFile.c) when parsing either format sub-chunks or unknown sub-chunks. This can be exploited to cause a heap-based buffer overflow via specially crafted WAV files with overly large chunk sizes specified (CVE-2012-6303).

Apply fix for CVE-2012-6303, where a crafted WAV file could cause a buffer overflow. Thanks to Michael Karcher for the patch.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
104616	openSUSE Security Update : snack (openSUSE-2017-1277)	Nessus	SuSE Local Security Checks	medium
81563	openSUSE Security Update : snack (openSUSE-2015-183)	Nessus	SuSE Local Security Checks	medium
69850	GLSA-201309-04 : Snack: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium
66138	Mandriva Linux Security Advisory : snack (MDVSA-2013:126)	Nessus	Mandriva Local Security Checks	medium
63504	Fedora 16 : tcl-snack-2.2.10-17.fc16 (2013-0110)	Nessus	Fedora Local Security Checks	medium
63503	Fedora 17 : tcl-snack-2.2.10-17.fc17 (2013-0098)	Nessus	Fedora Local Security Checks	medium
63502	Fedora 18 : tcl-snack-2.2.10-17.fc18 (2013-0083)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2012-6303

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium