PT-2007-7467 · Debian+1 · Nas-Bin+5

Published 1970-01-01 · Updated 2018-10-16 · CVE-2007-1543

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Network Audio System (NAS) versions prior to 1.8b Debian GNU/Linux package nas-bin (affected versions not specified) Debian GNU/Linux package libaudio2 (affected versions not specified) Debian GNU/Linux package nas-doc (affected versions not specified) Debian GNU/Linux package libaudio-dev (affected versions not specified)

Description The issue concerns multiple vulnerabilities in the Network Audio System (NAS) and related packages in Debian GNU/Linux, which can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. A specific vulnerability is a stack-based buffer overflow in the accept att local function, allowing remote attackers to execute arbitrary code via a long path slave name in a USL socket connection.

Recommendations For Network Audio System (NAS) versions prior to 1.8b, update to version 1.8b or later. For Debian GNU/Linux packages nas-bin, libaudio2, nas-doc, and libaudio-dev, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

BDU:2015-01300

BDU:2015-01301

BDU:2015-01303

BDU:2015-01304

BDU:2015-09562

CVE-2007-1543

DSA-1273-1

Affected Products

Debian

Network Audio System

Libaudio-Dev

Libaudio2

Nas-Bin

Nas-Doc

References · 33

• 🔥 http://aluigi.altervista.org/adv/nasbugs-adv.txt · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1547 · Security Note
• https://bdu.fstec.ru/vul/2015-09562 · Security Note
• https://bdu.fstec.ru/vul/2015-01303 · Security Note
• https://bdu.fstec.ru/vul/2015-01300 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1544 · Security Note
• http://debian.org/security/2007/dsa-1273 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2007:065 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1543 · Security Note
• http://security.gentoo.org/glsa/glsa-200704-20.xml · Vendor Advisory
• http://ubuntu.com/usn/usn-446-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01301 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1546 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2007-1543 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-1543 · Vendor Advisory