Are WAV files dangerous?

[Jose Maria Lopez Hernandez]

(e-mail address removed) (Bill Unruh) wrote:

|Well, no. A .wav file has a very definite format. The header is a fixed
|length header and the rest is pure data.

Not true. The .wav file can contain many chunks that vary in length.
See:

http://www.borg.com/~jglatt/tech/wave.htm

Note that if any of the chunks is processed in a buffer that is not
long enough, problems can result. The chunks are all defined with a
length field, but if not properly used, an overflow could result.

Phil

What could really happen it's that a constructed wave could make a
buffer overflow in a wave player. This could be a possibility, but it's
a bug in the software, not a problem in the wave file format.

--

Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
(e-mail address removed)
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
-- Jack Kerouac, "On the Road"

 

[xmp]

What could really happen it's that a constructed wave could make a
buffer overflow in a wave player. This could be a possibility, but it's
a bug in the software, not a problem in the wave file format.

That's true of most exploits whether stack overflows, format bugs, or
whatever. Most are simply coding errors which are inevitable. A few
are due to features, e.g. exploits that utilize My Computer Zone.
Others are intrinsic to the protocol, e.g. spoofing in TCP/IP. It will
be interesting to see what happens as more stuff is compiled with stack
and format guards.

I wonder if iDefense would pay for a media player exploit?

michael

 

[Bright]

That's true of most exploits whether stack overflows, format bugs, or
whatever. Most are simply coding errors which are inevitable. A few
are due to features, e.g. exploits that utilize My Computer Zone.
Others are intrinsic to the protocol, e.g. spoofing in TCP/IP. It will
be interesting to see what happens as more stuff is compiled with stack
and format guards.

I wonder if iDefense would pay for a media player exploit?

michael

So the answer to the original poster's question is YES ... er and NO


The format of WAV files is not so strongly restricted that it's not
possible for a file to be crafted that exploits a particular
impmentation of WAV play (whether this be by buffer overflow or or the
wrong data type for a particular field).

However, whether such a crafted WAV file can have an impact on a
target system is entirely dependant on the type of application which
is used upon it -
If you receive a crafted WAV file and don't do anything more with it
then it cannot have an impact.
If you load a crafted WAV file into an WAV player then it may have an
impact, particularly if the crafted vulnerability is aimed at your
specific WAV player (although other players may crash or evidence
other instability in the light of these non-standard WAV elements).

In the real world, where a significant market share is owned by
Microsoft and Windows Media Player then it seems reasonable to say
that a crafted WAV file aimed at this application will potentially
cause a problem, however, I'm not aware of a WAV exploit that has
successfuly targetted Windows Media Player (there may have been an
exploit of the 'skins' facility in this application ...but that uses a
different file type).

Regards

 

[Jose Maria Lopez Hernandez]

However, whether such a crafted WAV file can have an impact on a
target system is entirely dependant on the type of application which
is used upon it -
If you receive a crafted WAV file and don't do anything more with it
then it cannot have an impact.
If you load a crafted WAV file into an WAV player then it may have an
impact, particularly if the crafted vulnerability is aimed at your
specific WAV player (although other players may crash or evidence
other instability in the light of these non-standard WAV elements).

But that's true for almost every exploit you have out there. It only
will work if it has one concrete application or version of that
application listening to the data, so the case it's the same for WAV
files, they could be seen (if there would be any of them) as exploits
for some player.


--

Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
(e-mail address removed)
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
-- Jack Kerouac, "On the Road"