Bug 953516 (CVE-2015-7805) - VUL-0: CVE-2015-7805: libsndfile: 1.0.25 heap overflow
Summary: VUL-0: CVE-2015-7805: libsndfile: 1.0.25 heap overflow
Status: RESOLVED FIXED
Alias: CVE-2015-7805
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/158505/
Whiteboard: CVSSv2:NVD:CVE-2014-9756:5.0:(AV:N/A...
Keywords:
Depends on:
Blocks:
 
Reported: 2015-11-04 09:23 UTC by Sebastian Krahmer
Modified: 2018-10-19 18:39 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Patch #1 (upstream fix) (2.51 KB, patch)
2015-11-04 15:46 UTC, Takashi Iwai 		Details | Diff
Patch #2 (additional fix) (711 bytes, patch)
2015-11-04 15:47 UTC, Takashi Iwai 		Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sebastian Krahmer 2015-11-04 09:23:23 UTC 
Citing from Nemux site:

"While parsing a specially crafted AIFF header the attacker can manage index values in order to use memcpy(...) to overwrite memory heap."

CVE-2015-7805



References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7805
http://seclists.org/oss-sec/2015/q4/216
http://www.nemux.org/2015/10/13/libsndfile-1-0-25-heap-overflow/
https://packetstormsecurity.com/files/133926/libsndfile-1.0.25-Heap-Overflow.html
https://www.exploit-db.com/exploits/38447/
Comment 3 Takashi Iwai 2015-11-04 14:47:17 UTC 
I checked the latest libsndfile git and the issue can't be reproduced there.
There have been refactoring in src/aiff.c, and this magically fixes it.
But backporting it to 1.0.25 isn't trivial.  Let's see...
Comment 4 Takashi Iwai 2015-11-04 15:45:44 UTC 
OK, I managed to fix this somehow for libsndfile 1.0.25.  At least the given offender AIFF file is skipped properly now.

Two patches needed, one from upstream git and one my own.
Comment 5 Takashi Iwai 2015-11-04 15:46:36 UTC 
Created attachment 654617 [details]
Patch #1 (upstream fix)
Comment 6 Takashi Iwai 2015-11-04 15:47:00 UTC 
Created attachment 654618 [details]
Patch #2 (additional fix)
Comment 7 Swamp Workflow Management 2015-11-04 23:00:15 UTC 
bugbot adjusting priority
Comment 8 Takashi Iwai 2015-11-05 14:02:49 UTC 
Submitted to openSUSE-13.1, openSUSE-13.2, SLE11-SP1 and SLE12.
Comment 9 Bernhard Wiedemann 2015-11-05 15:00:23 UTC 
This is an autogenerated message for OBS integration:
This bug (953516) was mentioned in
https://build.opensuse.org/request/show/342564 13.1 / libsndfile
https://build.opensuse.org/request/show/342565 13.2 / libsndfile
Comment 10 Takashi Iwai 2015-11-05 17:14:08 UTC 
Fixed in all relevant branches.  Reassigning back to security team for the rest.
Comment 13 Swamp Workflow Management 2015-11-12 16:12:55 UTC 
SUSE-SU-2015:1979-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 953516,953521
CVE References: CVE-2014-9756,CVE-2015-7805
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    libsndfile-1.0.20-2.10.2
SUSE Linux Enterprise Software Development Kit 11-SP3 (src):    libsndfile-1.0.20-2.10.2
SUSE Linux Enterprise Server for VMWare 11-SP3 (src):    libsndfile-1.0.20-2.10.2
SUSE Linux Enterprise Server 11-SP4 (src):    libsndfile-1.0.20-2.10.2
SUSE Linux Enterprise Server 11-SP3 (src):    libsndfile-1.0.20-2.10.2
SUSE Linux Enterprise Desktop 11-SP4 (src):    libsndfile-1.0.20-2.10.2
SUSE Linux Enterprise Desktop 11-SP3 (src):    libsndfile-1.0.20-2.10.2
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    libsndfile-1.0.20-2.10.2
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    libsndfile-1.0.20-2.10.2
Comment 14 Swamp Workflow Management 2015-11-16 10:11:52 UTC 
openSUSE-SU-2015:1995-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 953516,953519,953521
CVE References: CVE-2014-9756,CVE-2015-7805,CVE-2015-8075
Sources used:
openSUSE 13.2 (src):    libsndfile-1.0.25-19.7.1, libsndfile-progs-1.0.25-19.7.1
openSUSE 13.1 (src):    libsndfile-1.0.25-17.7.1, libsndfile-progs-1.0.25-17.7.1
Comment 15 Swamp Workflow Management 2015-11-16 11:11:23 UTC 
SUSE-SU-2015:2000-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 953516,953519,953521
CVE References: CVE-2014-9756,CVE-2015-7805,CVE-2015-8075
Sources used:
SUSE Linux Enterprise Software Development Kit 12 (src):    libsndfile-1.0.25-24.1
SUSE Linux Enterprise Server 12 (src):    libsndfile-1.0.25-24.1
SUSE Linux Enterprise Desktop 12 (src):    libsndfile-1.0.25-24.1
Comment 16 Swamp Workflow Management 2015-11-27 16:11:05 UTC 
openSUSE-SU-2015:2119-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 953516,953519,953521
CVE References: CVE-2014-9756,CVE-2015-7805,CVE-2015-8075
Sources used:
openSUSE Leap 42.1 (src):    libsndfile-1.0.25-24.1, libsndfile-progs-1.0.25-24.1
Comment 17 Sebastian Krahmer 2015-11-30 14:23:11 UTC 
released
Comment 18 Swamp Workflow Management 2015-12-25 14:14:41 UTC 
SUSE-SU-2015:2000-2: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 953516,953519,953521
CVE References: CVE-2014-9756,CVE-2015-7805,CVE-2015-8075
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    libsndfile-1.0.25-25.1
SUSE Linux Enterprise Server 12-SP1 (src):    libsndfile-1.0.25-25.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    libsndfile-1.0.25-25.1