PT-2004-3747 · Sound Exchange · Sox

Ulf Harnhammar · Published 1970-01-01 · Updated 2017-10-11 · CVE-2004-0557

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SoX versions 12.17.2 through 12.17.4

Description The issue involves multiple buffer overflows in the st wavstartread function in wav.c for Sound eXchange (SoX), which can be exploited remotely. This can lead to the execution of arbitrary code via certain WAV file header fields, potentially disrupting the confidentiality, integrity, and availability of protected information.

Recommendations For SoX versions 12.17.2 through 12.17.4, consider updating to a version outside of this range to mitigate the risk of exploitation. As a temporary workaround, consider restricting the use of the st wavstartread function in wav.c until a patch is available. Avoid using SoX to process untrusted WAV files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

BDU:2015-03463

BDU:2015-03464

CVE-2004-0557

DSA-565-1

RHSA-2004:409

Affected Products

Sox

References · 24

• 🔥 https://exploit-db.com/exploits/374 · Exploit
• 🔥 http://securityfocus.com/bid/10819 · Exploit
• 🔥 https://exploit-db.com/exploits/369 · Exploit
• http://redhat.com/support/errata/RHSA-2004-409.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0557 · Vendor Advisory
• https://bugzilla.fedora.us/show_bug.cgi?id=1945 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2004:076 · Vendor Advisory
• http://debian.org/security/2004/dsa-565 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200407-23.xml · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2004-0557 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2004-0557 · Vendor Advisory
• http://lwn.net/Articles/95530 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03463 · Security Note
• https://bdu.fstec.ru/vul/2015-03464 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2004-0557 · Security Note