Multiple heap-based buffer overflows in Sound eXchange (SoX) 14.4.1 and earlier allow remote attackers to have unspecified impact via a crafted WAV file to the (1) start_read or (2) AdpcmReadBlock function.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sox: two heap out-of-bounds access issues (oCERT-2014-010) (CVE-2014-8145)

  - sox: null pointer dereference in function lsx_make_lpf in effect_i_dsp.c (CVE-2019-8357)

  - The startread function in wav.c in Sound eXchange (SoX) 14.4.2 allows remote attackers to cause a denial     of service (divide-by-zero error and application crash) via a crafted wav file. (CVE-2017-11332)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sox: two heap out-of-bounds access issues (oCERT-2014-010) (CVE-2014-8145)

  - sox: Use-after-free in lsx_aiffstartread (CVE-2017-15642)

  - The startread function in wav.c in Sound eXchange (SoX) 14.4.2 allows remote attackers to cause a denial     of service (divide-by-zero error and application crash) via a crafted wav file. (CVE-2017-11332)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sox: two heap out-of-bounds access issues (oCERT-2014-010) (CVE-2014-8145)

  - sox: Use-after-free in lsx_aiffstartread (CVE-2017-15642)

  - The startread function in wav.c in Sound eXchange (SoX) 14.4.2 allows remote attackers to cause a denial     of service (divide-by-zero error and application crash) via a crafted wav file. (CVE-2017-11332)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Mike Salvatore discovered that the fixes for these heap-based buffer overflows had not been properly applied in the Debian package.

For Debian 8 'Jessie', this problem has been fixed in version 14.4.1-5+deb8u1.

We recommend that you upgrade your sox packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201612-30 (SoX: User-assisted execution of arbitrary code)

    A heap-based buffer overflow can be triggered when processing a       malicious NIST Sphere or WAV audio file.
  Impact :

    A remote attacker could coerce the victim to run SoX against their       malicious file. This may be leveraged by an attacker to gain control of       program execution with the privileges of the user.
  Workaround :

    There is no known workaround at this time.

oCERT reports :

The sox command line tool is affected by two heap-based buffer overflows, respectively located in functions start_read() and AdpcmReadBlock().

A specially crafted wav file can be used to trigger the vulnerabilities.

Michele Spagnuolo of the Google Security Team discovered two heap-based buffer overflows in SoX, the Swiss Army knife of sound processing programs. A specially crafted wav file could cause an application using SoX to crash or, possibly, execute arbitrary code.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2014-8145

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated sox packages fix security vulnerability :

The sox command line tool is affected by two heap-based buffer overflows, respectively located in functions start_read() and AdpcmReadBlock(). A specially crafted wav file can be used to trigger the vulnerabilities (CVE-2014-8145).

Michele Spagnuolo of the Google Security Team dicovered two heap-based buffer overflows in SoX, the Swiss Army knife of sound processing programs. A specially crafted wav file could cause an application using SoX to crash or, possibly, execute arbitrary code.

ID	Name	Product	Family	Severity
199662	RHEL 7 : sox (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
199631	RHEL 6 : sox (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
199557	RHEL 5 : sox (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
122405	Debian DLA-1687-1 : sox security update	Nessus	Debian Local Security Checks	high
95698	GLSA-201612-30 : SoX: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
84971	FreeBSD : sox -- input sanitization errors (92cda470-30cb-11e5-a4a5-002590263bf5)	Nessus	FreeBSD Local Security Checks	high
82111	Debian DLA-128-1 : sox security update	Nessus	Debian Local Security Checks	high
81452	Fedora 21 : sox-14.4.1-7.fc21 (2015-1943)	Nessus	Fedora Local Security Checks	high
80434	Mandriva Linux Security Advisory : sox (MDVSA-2015:015)	Nessus	Mandriva Local Security Checks	high
80230	Debian DSA-3112-1 : sox - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2014-8145

high

Tenable Plugins

medium

medium

medium

high

high

high

high

high

high

high