Description
Array index error in Network Audio System (NAS) before 1.8a SVN 237 allows remote attackers to cause a denial of service (crash) via (1) large num_action values in the ProcAuSetElements function in server/dia/audispatch.c or (2) a large inputNum parameter to the compileInputs function in server/dia/auutil.c.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nas | 1.8-4 | — |
| Debian 13 | nas | 1.8-4 | — |
| Debian 12 | nas | 1.8-4 | — |
| Debian 3.1 | nas | 1.7-2sarge1 | DSA-1273-1 |
Advisories 1
- DSA-1273-1 nas - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- MDKSA-2007:065 vendor-advisory
- nas-compileinputs-dos(33055) vdb-entry
- 1017822 vdb-entry
- 24980 third-party-advisory
- 24527 third-party-advisory
- 23017 vdb-entry
- 24601 third-party-advisory
- USN-446-1 vendor-advisory
- 24628 third-party-advisory
- GLSA-200704-20 vendor-advisory
- ADV-2007-0997 vdb-entry
- nas-procausetelements-dos(33054) vdb-entry
- 20070403 FLEA-2007-0007-1: nas mailing-list
- 24638 third-party-advisory
- http://aluigi.altervista.org/adv/nasbugs-adv.txt
- DSA-1273 vendor-advisory
- http://www.radscan.com/nas/HISTORY