Multiple stack-based and heap-based buffer overflows in Network Audio System (NAS) 1.9.3 allow local users to cause a denial of service (crash) or possibly execute arbitrary code via the (1) display command argument to the ProcessCommandLine function in server/os/utils.c; (2) ResetHosts function in server/os/access.c; (3) open_unix_socket, (4) open_isc_local, (5) open_xsight_local, (6) open_att_local, or (7) open_att_svr4_local function in server/os/connection.c; the (8) AUDIOHOST environment variable to the CreateWellKnownSockets or (9) AmoebaTCPConnectorThread function in server/os/connection.c; or (10) unspecified vectors related to logging in the osLogMsg function in server/os/aulog.c.

The remote host is affected by the vulnerability described in GLSA-201406-22 (Network Audio System: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Network Audio System.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could possibly execute arbitrary code with       the privileges of the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Hamid Zamani reports :

multiple security problems (buffer overflows, format string vulnerabilities and missing input sanitising), which could lead to the execution of arbitrary code.

Hamid Zamani discovered multiple security problems (buffer overflows, format string vulnerabilities and missing input sanitising), which could lead to the execution of arbitrary code.

Hamid Zamani discovered multiple security issues in the Network Audio System (NAS) server. An attacker could possibly use these issues to cause a denial of service or execute arbitrary code. (CVE-2013-4256, CVE-2013-4257).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This release fixes four security bugs: buffer overflow when parsing display number (CVE-2013-4256), heap overflow when processing AUDIOHOST variable (CVE-2013-4257), formatting string for syslog call (CVE-2013-4258), and a race when opening a TCP device.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
76224	GLSA-201406-22 : Network Audio System: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
73553	FreeBSD : nas -- multiple vulnerabilities (bf7912f5-c1a8-11e3-a5ac-001b21614864)	Nessus	FreeBSD Local Security Checks	high
70355	Debian DSA-2771-1 : nas - several vulnerabilities	Nessus	Debian Local Security Checks	high
70270	Ubuntu 12.04 LTS / 12.10 / 13.04 : nas vulnerabilities (USN-1986-1)	Nessus	Ubuntu Local Security Checks	medium
70156	Fedora 19 : nas-1.9.3-7.fc19 (2013-17036)	Nessus	Fedora Local Security Checks	medium
70155	Fedora 18 : nas-1.9.3-4.fc18 (2013-16989)	Nessus	Fedora Local Security Checks	medium
70153	Fedora 20 : nas-1.9.3-9.fc20 (2013-16936)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-4256

high

Tenable Plugins

high

high

high

medium

medium

medium

medium