Denial of service in Freeware Advanced Audio Decoder
| Risk | Low |
| Patch available | NO |
| Number of vulnerabilities | 6 |
| CVE-ID | CVE-2018-20194 CVE-2018-20196 CVE-2018-20197 CVE-2018-20195 CVE-2018-20198 CVE-2018-20199 |
| CWE-ID | CWE-124 CWE-121 CWE-476 |
| Exploitation vector | Local |
| Public exploit |
Public exploit code for vulnerability #1 is available. Public exploit code for vulnerability #2 is available. Public exploit code for vulnerability #3 is available. Public exploit code for vulnerability #4 is available. Public exploit code for vulnerability #5 is available. Public exploit code for vulnerability #6 is available. |
| Vulnerable software Subscribe |
Freeware Advanced Audio Decoder Client/Desktop applications / Multimedia software |
| Vendor | Krzysztof Nikiel |
Security Bulletin
This security bulletin contains information about 6 vulnerabilities.
1) Stack-based buffer underflow
EUVDB-ID: #VU16630
Risk: Low
CVSSv3.1: 3.2 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:U/RC:C]
CVE-ID: CVE-2018-20194
CWE-ID:
CWE-124 - Buffer Underwrite ('Buffer Underflow')
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to cause DoS condition on the target system.
The vulnerability exists due to the calculate_gain function, as defined in the libfaad/sbr_hfadj.c source code file of the affected software, mishandles noise energy level for the G_max <= G case. A local attacker can submit malicious input and trigger a stack-based buffer underflow condition that causes the affected software to crash, resulting in a DoS condition.
MitigationCybersecurity Help is currently unaware of any official solution to address the vulnerability.
Vulnerable software versionsFreeware Advanced Audio Decoder: 2.8.8
External linkshttp://github.com/knik0/faad2/issues/21
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
2) Stack-based buffer overflow
EUVDB-ID: #VU16631
Risk: Low
CVSSv3.1: 3.2 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:U/RC:C]
CVE-ID: CVE-2018-20196
CWE-ID:
CWE-121 - Stack-based buffer overflow
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to cause DoS condition on the target system.
The vulnerability exists due to the calculate_gain function, as defined in the libfaad/sbr_hfadj.c source code file of the affected software, mishandles the S_M array. A local attacker can submit malicious input and trigger a stack-based buffer overflow condition that causes the affected software to crash, resulting in a DoS condition.
MitigationCybersecurity Help is currently unaware of any official solution to address the vulnerability.
Vulnerable software versionsFreeware Advanced Audio Decoder: 2.8.8
External linkshttp://github.com/knik0/faad2/issues/19
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
3) Stack-based buffer underflow
EUVDB-ID: #VU16632
Risk: Low
CVSSv3.1: 3.2 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:U/RC:C]
CVE-ID: CVE-2018-20197
CWE-ID:
CWE-124 - Buffer Underwrite ('Buffer Underflow')
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to cause DoS condition on the target system.
The vulnerability exists due to the calculate_gain function, as defined in the libfaad/sbr_hfadj.c source code file of the affected software, mishandles noise energy level for the G_max = G case. A local attacker can submit malicious input and trigger a stack-based buffer underflow condition that causes the affected software to crash, resulting in a DoS condition.
MitigationCybersecurity Help is currently unaware of any official solution to address the vulnerability.
Vulnerable software versionsFreeware Advanced Audio Decoder: 2.8.8
External linkshttp://github.com/knik0/faad2/issues/20
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
4) NULL pointer dereference
EUVDB-ID: #VU16633
Risk: Low
CVSSv3.1: 3.2 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:U/RC:C]
CVE-ID: CVE-2018-20195
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to cause DoS condition on the target system.
The vulnerability exists due to a NULL pointer dereference in ic_predict of libfaad/ic_predict.c. A local attacker can submit malicious input and trigger a segmentation fault that causes the affected software to crash, resulting in a DoS condition.
MitigationCybersecurity Help is currently unaware of any official solution to address the vulnerability.
Vulnerable software versionsFreeware Advanced Audio Decoder: 2.8.8
External linkshttp://github.com/knik0/faad2/issues/25
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
5) NULL pointer dereference
EUVDB-ID: #VU16634
Risk: Low
CVSSv3.1: 3.2 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:U/RC:C]
CVE-ID: CVE-2018-20198
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to cause DoS condition on the target system.
The vulnerability exists due to a NULL pointer dereference in ifilter_bank of libfaad/filtbank.c. A local attacker can submit trigger a segmentation fault that causes the affected software to crash, resulting in a DoS condition because adding to windowed output is mishandled in the LONG_START_SEQUENCE case.
MitigationCybersecurity Help is currently unaware of any official solution to address the vulnerability.
Vulnerable software versionsFreeware Advanced Audio Decoder: 2.8.8
External linkshttp://github.com/knik0/faad2/issues/23
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
6) NULL pointer dereference
EUVDB-ID: #VU16635
Risk: Low
CVSSv3.1: 3.2 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:U/RC:C]
CVE-ID: CVE-2018-20199
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to cause DoS condition on the target system.
The vulnerability exists due to a NULL pointer dereference in ifilter_bank of libfaad/filtbank.c. A local attacker can trigger a segmentation fault that causes the affected software to crash, resulting in a DoS condition because adding to windowed output is mishandled in the ONLY_LONG_SEQUENCE case.
MitigationCybersecurity Help is currently unaware of any official solution to address the vulnerability.
Vulnerable software versionsFreeware Advanced Audio Decoder: 2.8.8
External linkshttp://github.com/knik0/faad2/issues/24
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
