In the startread function in xa.c in Sound eXchange (SoX) through 14.4.2, a corrupt header specifying zero channels triggers an infinite loop with a resultant NULL pointer dereference, which may allow a remote attacker to cause a denial-of-service.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-2283 advisory.

    [14.4.1-7]
    - Fix CVE-2017-18189       Upstream patch: https://sourceforge.net/p/sox/code/ci/09d7388c8ad5701ed9c59d1d600ff6154b066397/       Resolves: #1553590

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Fixes **CVE-2017-18189**.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has sox packages installed that are affected by a vulnerability:

  - In the startread function in xa.c in Sound eXchange     (SoX) through 14.4.2, a corrupt header specifying zero     channels triggers an infinite loop with a resultant NULL     pointer dereference, which may allow a remote attacker     to cause a denial-of-service. (CVE-2017-18189)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A NULL pointer dereference flaw found in the way SoX handled processing of AIFF files. An attacker could potentially use this flaw to crash the SoX application by tricking it into processing crafted AIFF files.(CVE-2017-18189)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has sox packages installed that are affected by a vulnerability:

  - In the startread function in xa.c in Sound eXchange     (SoX) through 14.4.2, a corrupt header specifying zero     channels triggers an infinite loop with a resultant NULL     pointer dereference, which may allow a remote attacker     to cause a denial-of-service. (CVE-2017-18189)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for sox is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

SoX (Sound eXchange) is a sound file format converter. SoX can convert between many different digitized sound formats and perform simple sound manipulation functions, including sound effects.

Security Fix(es) :

* sox: NULL pointer dereference in startread function in xa.c (CVE-2017-18189)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

Security Fix(es) :

  - sox: NULL pointer dereference in startread function in     xa.c (CVE-2017-18189)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:2283 advisory.

    SoX (Sound eXchange) is a sound file format converter. SoX can convert between many different digitized     sound formats and perform simple sound manipulation functions, including sound effects.

    Security Fix(es):

    * sox: NULL pointer dereference in startread function in xa.c (CVE-2017-18189)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities have been discovered in SoX (Sound eXchange), a sound processing program :

CVE-2017-15370

The ImaAdpcmReadBlock function (src/wav.c) is affected by a heap buffer overflow. This vulnerability might be leveraged by remote attackers using a crafted WAV file to cause denial of service (application crash).

CVE-2017-15372

The lsx_ms_adpcm_block_expand_i function (adpcm.c) is affected by a stack based buffer overflow. This vulnerability might be leveraged by remote attackers using a crafted audio file to cause denial of service (application crash).

CVE-2017-15642

The lsx_aiffstartread function (aiff.c) is affected by a use-after-free vulnerability. This flaw might be leveraged by remote attackers using a crafted AIFF file to cause denial of service (application crash).

CVE-2017-18189

The startread function (xa.c) is affected by a NULL pointer dereference vulnerability. This flaw might be leveraged by remote attackers using a crafted Maxis XA audio file to cause denial of service (application crash).

For Debian 8 'Jessie', these problems have been fixed in version 14.4.1-5+deb8u2.

We recommend that you upgrade your sox packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the sox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - SoX (Sound eXchange) is a sound file format converter     SoX can convert between many different digitized sound     formats and perform simple sound manipulation     functions, including sound effects.

  - Security fix(es):

  - A NULL pointer dereference flaw found in the way SoX     handled processing of AIFF files. An attacker could     potentially use this flaw to crash the SoX application     by tricking it into processing crafted AIFF     files.(CVE-2017-18189)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sox fixes the following issues :

  - CVE-2017-11332: Fixed the startread function in wav.c,     which allowed remote attackers to cause a DoS     (divide-by-zero) via a crafted wav file. (boo#1081140)

  - CVE-2017-11358: Fixed the read_samples function in     hcom.c, which allowed remote attackers to cause a DoS     (invalid memory read) via a crafted hcom file.
    (boo#1081141)

  - CVE-2017-11359: Fixed the wavwritehdr function in wav.c,     which allowed remote attackers to cause a DoS     (divide-by-zero) when converting a a crafted snd file to     a wav file. (boo#1081142)

  - CVE-2017-15370: Fixed a heap-based buffer overflow in     the ImaExpandS function of ima_rw.c, which allowed     remote attackers to cause a DoS during conversion of a     crafted audio file. (boo#1063439)

  - CVE-2017-15371: Fixed an assertion abort in the function     sox_append_comment() in formats.c, which allowed remote     attackers to cause a DoS during conversion of a crafted     audio file. (boo#1063450)

  - CVE-2017-15372: Fixed a stack-based buffer overflow in     the lsx_ms_adpcm_block_expand_i function of adpcm.c,     which allowed remote attackers to cause a DoS during     conversion of a crafted audio file. (boo#1063456)

  - CVE-2017-15642: Fixed an Use-After-Free vulnerability in     lsx_aiffstartread in aiff.c, which could be triggered by     an attacker by providing a malformed AIFF file.
    (boo#1064576)

  - CVE-2017-18189: Fixed a NULL pointer dereference     triggered by a corrupt header specifying zero channels     in the startread function in xa.c, which allowed remote     attackers to cause a DoS (boo#1081146).

ID	Name	Product	Family	Severity
180791	Oracle Linux 7 : sox (ELSA-2019-2283)	Nessus	Oracle Linux Local Security Checks	high
133583	Fedora 30 : sox (2020-cb7b7181a0)	Nessus	Fedora Local Security Checks	high
133421	Fedora 31 : sox (2020-1dfaa1963b)	Nessus	Fedora Local Security Checks	high
132452	NewStart CGSL CORE 5.05 / MAIN 5.05 : sox Vulnerability (NS-SA-2019-0251)	Nessus	NewStart CGSL Local Security Checks	high
130604	Amazon Linux 2 : sox (ALAS-2019-1352)	Nessus	Amazon Linux Local Security Checks	high
129909	NewStart CGSL CORE 5.04 / MAIN 5.04 : sox Vulnerability (NS-SA-2019-0203)	Nessus	NewStart CGSL Local Security Checks	high
128383	CentOS 7 : sox (CESA-2019:2283)	Nessus	CentOS Local Security Checks	high
128262	Scientific Linux Security Update : sox on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	high
127705	RHEL 7 : sox (RHSA-2019:2283)	Nessus	Red Hat Local Security Checks	high
122512	Debian DLA-1695-1 : sox security update	Nessus	Debian Local Security Checks	high
109482	EulerOS 2.0 SP2 : sox (EulerOS-SA-2018-1084)	Nessus	Huawei Local Security Checks	high
109481	EulerOS 2.0 SP1 : sox (EulerOS-SA-2018-1083)	Nessus	Huawei Local Security Checks	high
106917	openSUSE Security Update : sox (openSUSE-2018-185)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2017-18189

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high