Wavpack up to 5.1.0 DFF File pack_utils.c WavpackSetConfiguration64 uninitialized pointer

Summaryinfo

A vulnerability labeled as problematic has been found in Wavpack up to 5.1.0. This affects the function WavpackSetConfiguration64 of the file pack_utils.c of the component DFF File Handler. The manipulation results in uninitialized pointer. This vulnerability is cataloged as CVE-2019-11498. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Wavpack up to 5.1.0. Affected is the function WavpackSetConfiguration64 of the file pack_utils.c of the component DFF File Handler. The manipulation with an unknown input leads to a uninitialized pointer vulnerability. CWE is classifying the issue as CWE-824. The product accesses or uses a pointer that has not been initialized. This is going to have an impact on availability. CVE summarizes:

WavpackSetConfiguration64 in pack_utils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on uninitialised value" condition, which might allow attackers to cause a denial of service (application crash) via a DFF file that lacks valid sample-rate data.

The bug was discovered 03/04/2019. The weakness was shared 04/24/2019 (Website). The advisory is shared for download at lists.fedoraproject.org. This vulnerability is traded as CVE-2019-11498 since 04/24/2019. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 51 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 236638 (Alibaba Cloud Linux 3 : 0061: wavpack (ALINUX3-SA-2022:0061)), which helps to determine the existence of the flaw in a target environment. The commercial vulnerability scanner Qualys is able to test this issue with plugin 197443 (Ubuntu Security Notification for Wavpack Vulnerability (USN-3960-1)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (236638). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Wavpack

Version

• 5.0
• 5.1.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion