Denial of service in WavPack

Published: 2018-12-05
Severity Low
Patch available YES
Number of vulnerabilities 2
CVE ID CVE-2018-19841
CVE-2018-19840
CWE ID CWE-125
CWE-835
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Public exploit code for vulnerability #2 is available.
Vulnerable software WavPack Subscribe
Vendor wavpack

Security Advisory

1) Out-of-bounds read

Severity: Low

CVSSv3: 5.9 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C] [PCI]

CVE-ID: CVE-2018-19841

CWE-ID: CWE-125 - Out-of-bounds Read

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists in the WavpackVerifySingleBlock function, as defined in the open_utils.c source code file due to improper processing of WavPack lossless audio files. A remote attacker can trick the victim into accessing a WavPack lossless audio file that submits malicious, trigger an out-of-bounds read condition and cause the affected software to crash, resulting in a DoS condition.

Mitigation

Install update from vendor's website.

Vulnerable software versions

WavPack: 4.1, 4.2, 4.3, 4.22, 4.31, 4.32, 4.40, 4.41, 4.50, 4.50.1, 4.60, 4.60.1, 4.70.0, 4.75.0, 4.75.2, 4.80.0, 5.0.0, 5.1.0

CPE External links

https://github.com/dbry/WavPack/issues/54

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Infinite loop

Severity: Low

CVSSv3: 5.9 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C] [PCI]

CVE-ID: CVE-2018-19840

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists in the WavpackPackInit function, as defined in the pack_utils.csource code file due to the WavpackSetConfiguration64 function improperly handles a block sample rate of zero. A remote attacker can trick the victim into accessing a .wav file that submits malicious, trigger an infinite loop condition that could consume excessive resources and cause the affected software to crash, resulting in a DoS condition.

Mitigation

Install update from vendor's website.

Vulnerable software versions

WavPack: 4.1, 4.2, 4.3, 4.22, 4.31, 4.32, 4.40, 4.41, 4.50, 4.50.1, 4.60, 4.60.1, 4.70.0, 4.75.0, 4.75.2, 4.80.0, 5.0.0, 5.1.0

CPE External links

https://github.com/dbry/WavPack/issues/53

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.