Attachment 22255 Details for Bug 58116

mail on vendor-sec

sox (text/plain), 4.31 KB, created by Ludwig Nussel on 2004-07-19 17:37:09 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ludwig Nussel

Created: 2004-07-19 17:37:09 UTC

Size: 4.31 KB

patch

obsolete

>Hello,
>
>I have found two buffer overflows in SoX. They occur when the sox
>or play commands handle malicious .WAV files.
>
>Versions 12.17.4, 12.17.3 and 12.17.2 are vulnerable to these
>overflows. 12.17.1, 12.17 and 12.16 are some versions that are not.
>
>SoX may not be the most security critical program, but it is possible
>to exploit this. Some attack vectors are social engineering (I have
>used play to play .WAV files from untrusted sources several times
>before I found this), programs that use SoX to play data from the net
>(examples include JiveAudio and vmail), and people who put play in
>their mailcap files (so it plays sound files in MIME messages as
>soon as the messages are opened). It is also interesting to note
>that xmms can play .WAV files with this type of data just fine.
>
>Both overflows occur in wav.c in the function st_wavstartread().
>In both cases, the program first reads 4 bytes from the .WAV file
>into a variable. Then it reads as many bytes as that variable says
>from the .WAV file into a 256 bytes long char array, without checking
>if the data from the .WAV file fits in that array. This leads to a
>stack-based buffer overflow with control over EIP, as you can see
>in this session capture:
>
>
>$ play buffy.wav
>playing buffy.wav
>/usr/bin/play: line 1:  4990 Segmentation fault      sox $volume
>$fopts $fopts2 "$filename_0" $arch_defines $device $effects
>$ sox buffy.wav -t ossdsp /dev/dsp
>Segmentation fault
>$ gdb /usr/bin/sox
>GNU gdb 6.1-debian
>Copyright 2004 Free Software Foundation, Inc.
>GDB is free software, covered by the GNU General Public License, and
>you are welcome to change it and/or distribute copies of it under
>certain conditions.
>Type "show copying" to see the conditions.
>There is absolutely no warranty for GDB.  Type "show warranty" for
>details.
>This GDB was configured as "i386-linux"......Using host libthread_db
>library "/lib/libthread_db.so.1".
>
>(gdb) r buffy.wav -t ossdsp /dev/dsp
>Starting program: /usr/bin/sox buffy.wav -t ossdsp /dev/dsp
>Program received signal SIGSEGV, Segmentation fault.
>0x55555555 in ?? ()
>(gdb) i r
>eax            0x0      0
>ecx            0x0      0
>edx            0x0      0
>ebx            0x55555555       1431655765
>esp            0xbffff940       0xbffff940
>ebp            0x55555555       0x55555555
>esi            0x55555555       1431655765
>edi            0x55555555       1431655765
>eip            0x55555555       0x55555555
>eflags         0x10282  66178
>cs             0x23     35
>ss             0x2b     43
>ds             0x2b     43
>es             0x2b     43
>fs             0x0      0
>gs             0x0      0
>(gdb) bt
>#0  0x55555555 in ?? ()
>#1  0x55555555 in ?? ()
>#2  0x55555555 in ?? ()
>#3  0x55555555 in ?? ()
>#4  0x55555555 in ?? ()
>#5  0x55555555 in ?? ()
>#6  0x55555555 in ?? ()
>#7  0xbffff900 in ?? ()
>#8  0x08072fa2 in _IO_stdin_used ()
>#9  0x00008572 in ?? ()
>#10 0x45564157 in ?? ()
>#11 0x002a5550 in ?? ()
>#12 0x0807d0b8 in ?? ()
>#13 0x0807d3c4 in ?? ()
>#14 0x080a4400 in ?? ()
>#15 0xbffff9a8 in ?? ()
>#16 0x0804c9b7 in ?? ()
>#17 0x08072f56 in _IO_stdin_used ()
>#18 0xbffffb74 in ?? ()
>#19 0x00000000 in ?? ()
>#20 0x00000000 in ?? ()
>#21 0x080a4400 in ?? ()
>#22 0x00000005 in ?? ()
>#23 0xbffff9c8 in ?? ()
>#24 0x0804ad4b in ?? ()
>#25 0x080a3cd8 in ?? ()
>#26 0x00000001 in ?? ()
>#27 0xbffff9c8 in ?? ()
>#28 0x0804a42b in ?? ()
>#29 0x080a4400 in ?? ()
>#30 0x000005b4 in ?? ()
>#31 0x76000001 in ?? ()
>#32 0x00000005 in ?? ()
>#33 0x080a4400 in ?? ()
>#34 0x00000005 in ?? ()
>#35 0xbffff9f8 in ?? ()
>#36 0x0804a08b in ?? ()
>#37 0x080a4400 in ?? ()
>#38 0x00000005 in ?? ()
>#39 0xbffffa54 in ?? ()
>#40 0x080725bb in ?? ()
>#41 0x402a5550 in ?? () from /lib/libc.so.6
>#42 0x08072600 in ?? ()
>#43 0x00000001 in ?? ()
>#44 0x402a5550 in ?? () from /lib/libc.so.6
>#45 0x400164a0 in ?? () from /lib/ld-linux.so.2
>#46 0xbffffa54 in ?? ()
>#47 0xbffffa28 in ?? ()
>#48 0x4018bdc6 in __libc_start_main () from /lib/libc.so.6
>Previous frame inner to this frame (corrupt stack?)
>(gdb) q
>The program is running.  Exit anyway? (y or n) y
>$
>
>
>I have attached a .WAV file that causes a buffer overflow, as well
>as a patch against 12.17.4 that stops both overflows.
>
>I hope that all addressed people can coordinate our releases of
>SoX to correct this security problem at the same time. How much
>time do you need before the coordinated release?
>
>// Ulf Harnhammar
>   Debian Security Audit Project
>   http://www.debian.org/security/audit/
>

Actions: View

Attachments on bug 58116: 22255 | 22256 | 22257 | 22259 | 22260