Hide Forgot
A heap-based buffer overflow vulnerability was found in libsndfile. Vulnerability is based on the wrong management of the headindex and headend values. While parsing a specially crafted AIFF header, the attacker can manage index values in order to use memcpy(...) to overwrite memory heap. Affected versions are <= 1.0.25. Reproducer: https://packetstormsecurity.com/files/133926/libsndfile-1.0.25-Heap-Overflow.html CVE assignment: http://seclists.org/oss-sec/2015/q4/216
Created audacity tracking bugs for this issue: Affects: fedora-all [bug 1277902] Affects: epel-all [bug 1277904]
Created jack-audio-connection-kit tracking bugs for this issue: Affects: fedora-all [bug 1277901] Affects: epel-all [bug 1277903]
Created libsndfile tracking bugs for this issue: Affects: epel-5 [bug 1277905]
Created pulseaudio tracking bugs for this issue: Affects: epel-5 [bug 1277906]
The problem appears to be in the header_read() function in src/common.c >> if (psf->headindex + bytes > SIGNED_SIZEOF (psf->header)) >> 806 { int most ; >> 807 >> 808 most = SIGNED_SIZEOF (psf->header) - psf->headindex ; >> 809 psf_fread (psf->header + psf->headend, 1, most, psf) ; >> 810 memset ((char *) ptr + most, 0, bytes - most) ; >> 811 >> 812 psf_fseek (psf, bytes - most, SEEK_CUR) ; >> 813 return bytes ; >> 814 } ; line 808 is trying to calculate the maximum remaining space in the header, "most". However, this calculation does not take "psf->headend" into account. in line 809, psf_fread() tries to append "most" bytes to the header, but the start is offset by "psf->headend". Since "psf->headend" was not part of the "most" calculation, we end up overflowing psf->header. After the psf->header, there are a couple function pointers for special IO functions. It's possible to e.g. overwrite the "seek" function pointer, which causes the psf_fseek() in line 812 to ultimately jump to a location controlled by the attacker.
libsndfile-1.0.25-17.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
libsndfile-1.0.17-7.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report.
libsndfile-1.0.25-17.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
libsndfile-1.0.25-16.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.