PT-2013-1052 · Network Audio System+2 · Network Audio System+2

Hamid Zamani · Published 2013-10-09 · Updated 2016-12-31 · CVE-2013-4258

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Network Audio System (NAS) versions prior to 1.9.4 Gentoo Linux (affected versions not specified) Debian GNU/Linux (affected versions not specified)

Description The issue concerns multiple vulnerabilities in the NAS package of Gentoo Linux and Debian GNU/Linux operating systems. These vulnerabilities can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. A specific format string vulnerability in the osLogMsg function in server/os/aulog.c in Network Audio System (NAS) 1.9.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in unspecified vectors, related to syslog.

Recommendations For Network Audio System (NAS) versions prior to 1.9.4, update to version 1.9.4 or later to resolve the issue. For Gentoo Linux, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Debian GNU/Linux, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-119

CWE-134

Related Identifiers

BDU:2015-01302

BDU:2015-09743

CVE-2013-4258

DSA-2771-1

Affected Products

Debian

Gentoo Linux

Network Audio System

References · 18

• 🔥 http://radscan.com/pipermail/nas/2013-August/001270.html · Exploit
• https://bdu.fstec.ru/vul/2015-09743 · Security Note
• https://bdu.fstec.ru/vul/2015-01302 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4258 · Security Note
• https://osv.dev/vulnerability/CVE-2013-4258 · Vendor Advisory
• http://debian.org/security/2013/dsa-2771 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4257 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4256 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2013-4258 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4258 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4258 · Vendor Advisory
• http://openwall.com/lists/oss-security/2013/08/19/3 · Note
• http://openwall.com/lists/oss-security/2013/08/16/2 · Note
• http://securityfocus.com/bid/61852 · Note
• http://debian.org/security/dsa-2771 · Note