Heap-based buffer overflow in SoundTouch - CVE-2018-1000223
Published: October 12, 2018 / Updated: October 15, 2018
Vulnerability identifier: #VU15361
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-1000223
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists in the WavInFile::readHeaderBlock() function, as defined in the SoundStretch/WavFile.cpp file due to the use of a signed integer instead of an unsigned integer when the size of a structure is calculated. A remote unauthenticated attacker can trick the victim into opening a specially crafted file with the SoundStretch utility that submits malicious input, trigger a heap-based buffer overflow and execute arbitrary code with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
SoundTouch
Opensuse
Fedora
soundtouch
Opensuse
Fedora
soundtouch
How to mitigate CVE-2018-1000223
Update to version 2.1.
SoundTouch - update to 2.1
soundtouch - addressed in versions 2.0.0-6.fc27, 2.0.0-6.fc28
soundtouch - addressed in versions 2.0.0-6.fc27, 2.0.0-6.fc28