CVE-2013-4256
Multiple stack-based and heap-based buffer overflows in Network Audio System (NAS) 1.9.3 allow...
Multiple stack-based and heap-based buffer overflows in Network Audio System (NAS) 1.9.3 allow local users to cause a denial of service (crash) or possibly execute arbitrary code via the (1) display command argument to the ProcessCommandLine function in server/os/utils.c; (2) ResetHosts function in server/os/access.c; (3) open_unix_socket, (4) open_isc_local, (5) open_xsight_local, (6) open_att_local, or (7) open_att_svr4_local function in server/os/connection.c; the (8) AUDIOHOST environment variable to the CreateWellKnownSockets or (9) AmoebaTCPConnectorThread function in server/os/connection.c; or (10) unspecified vectors related to logging in the osLogMsg function in server/os/aulog.c.
Exploit likelihood
What each source reports
NVD Score used
Multiple stack-based and heap-based buffer overflows in Network Audio System (NAS) 1.9.3 allow local users to cause a denial of service (crash) or possibly execute arbitrary code via the (1) display command argument to the ProcessCommandLine function in server/os/utils.c; (2) ResetHosts function in server/os/access.c; (3) open_unix_socket, (4) open_isc_local, (5) open_xsight_local, (6) open_att_local, or (7) open_att_svr4_local function in server/os/connection.c; the (8) AUDIOHOST environment variable to the CreateWellKnownSockets or (9) AmoebaTCPConnectorThread function in server/os/connection.c; or (10) unspecified vectors related to logging in the osLogMsg function in server/os/aulog.c.
- Record
CVE-2013-4256- CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Multiple stack-based and heap-based buffer overflows in Network Audio System (NAS) 1.9.3 allow local users to cause a denial of service (crash) or possibly execute arbitrary code via the (1) display command argument to the ProcessCommandLine function in server/os/utils.c; (2) ResetHosts function in server/os/access.c; (3) open_unix_socket, (4) open_isc_local, (5) open_xsight_local, (6) open_att_local, or (7) open_att_svr4_local function in server/os/connection.c; the (8) AUDIOHOST environment variable to the CreateWellKnownSockets or (9) AmoebaTCPConnectorThread function in server/os/connection.c; or (10) unspecified vectors related to logging in the osLogMsg function in server/os/aulog.c.
- Record
CVE-2013-4256- Updated
- 2026-11-02
EUVDEUVD-2013-4158 No score
Multiple stack-based and heap-based buffer overflows in Network Audio System (NAS) 1.9.3 allow local users to cause a denial of service (crash) or possibly execute arbitrary code via the (1) display command argument to the ProcessCommandLine function in server/os/utils.c; (2) ResetHosts function in server/os/access.c; (3) open_unix_socket, (4) open_isc_local, (5) open_xsight_local, (6) open_att_local, or (7) open_att_svr4_local function in server/os/connection.c; the (8) AUDIOHOST environment variable to the CreateWellKnownSockets or (9) AmoebaTCPConnectorThread function in server/os/connection.c; or (10) unspecified vectors related to logging in the osLogMsg function in server/os/aulog.c.
- Record
EUVD-2013-4158- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-whq2-g3c2-x5j3 No score
Multiple stack-based and heap-based buffer overflows in Network Audio System (NAS) 1.9.3 allow...
Multiple stack-based and heap-based buffer overflows in Network Audio System (NAS) 1.9.3 allow local users to cause a denial of service (crash) or possibly execute arbitrary code via the (1) display command argument to the ProcessCommandLine function in server/os/utils.c; (2) ResetHosts function in server/os/access.c; (3) open_unix_socket, (4) open_isc_local, (5) open_xsight_local, (6) open_att_local, or (7) open_att_svr4_local function in server/os/connection.c; the (8) AUDIOHOST environment variable to the CreateWellKnownSockets or (9) AmoebaTCPConnectorThread function in server/os/connection.c; or (10) unspecified vectors related to logging in the osLogMsg function in server/os/aulog.c.
- Record
GHSA-whq2-g3c2-x5j3- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Multiple stack-based and heap-based buffer overflows in Network Audio System (NAS) 1.9.3 allow local users to cause a denial of service (crash) or possibly execute arbitrary code via the (1) display command argument to the ProcessCommandLine function in server/os/utils.c; (2) ResetHosts function in server/os/access.c; (3) open_unix_socket, (4) open_isc_local, (5) open_xsight_local, (6) open_att_local, or (7) open_att_svr4_local function in server/os/connection.c; the (8) AUDIOHOST environment variable to the CreateWellKnownSockets or (9) AmoebaTCPConnectorThread function in server/os/connection.c; or (10) unspecified vectors related to logging in the osLogMsg function in server/os/aulog.c.
- Record
CVE-2013-4256- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4256 No score
Multiple stack-based and heap-based buffer overflows in Network Audio System (NAS) 1.9.3 allow local users to cause a denial of service (crash) or possibly execute arbitrary code via the (1) display command argument to the ProcessCommandLine function in server/os/utils.c; (2) ResetHosts function in server/os/access.c; (3) open_unix_socket, (4) open_isc_local, (5) open_xsight_local, (6) open_att_local, or (7) open_att_svr4_local function in server/os/connection.c; the (8) AUDIOHOST environment variable to the CreateWellKnownSockets or (9) AmoebaTCPConnectorThread function in server/os/connection.c; or (10) unspecified vectors related to logging in the osLogMsg function in server/os/aulog.c.
- Record
DEBIAN-CVE-2013-4256- Updated
- 2026-11-02
OSVMGASA-2013-0298 No score
Updated nas packages fix security vulnerabilities
Updated nas packages fix security vulnerabilities:
Buffer overflow when parsing display number and various other buffer overflows (CVE-2013-4256).
Heap overflow when using AUDIOHOST environment variable (CVE-2013-4257).
Race when opening a TCP device (nas#289).
- Record
MGASA-2013-0298- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nasDebian:12 |
before 1.9.3-6 | 1.9.3-6 |
nasDebian:13 |
before 1.9.3-6 | 1.9.3-6 |
nasDebian:14 |
before 1.9.3-6 | 1.9.3-6 |
nasDebian:6.0 From an advisory covering 2 CVEs |
before 1.9.2-4squeeze1, plus listed versions 1.9.2-4 |
1.9.2-4squeeze1 |
nasDebian:7 From an advisory covering 2 CVEs |
before 1.9.3-5wheezy1, plus listed versions 1.9.3-5 |
1.9.3-5wheezy1 |
nasMageia:2 From an advisory covering 2 CVEs |
before 1.9.2-6.1.mga2 | 1.9.2-6.1.mga2 |
nasMageia:3 From an advisory covering 2 CVEs |
before 1.9.3-2.1.mga3 | 1.9.3-2.1.mga3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4256 is a medium vulnerability (CVSS 4.6) in Radscan Network Audio System, published October 9, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.70%, the 53rd percentile. Fixed in nas 1.9.3-6.
References
openwall.com/lists/oss-security/2013/08/19/3
radscan.com/pipermail/nas/2013-August/001270.html
sourceforge.net/p/nas/code/288
debian.org/security/2013/dsa-2771
securityfocus.com/bid/61848
Show 8 moreShow less
ubuntu.com/usn/USN-1986-1
nvd.nist.gov/vuln/detail/CVE-2013-4256
github.com/advisories/GHSA-whq2-g3c2-x5j3
security-tracker.debian.org/tracker/CVE-2013-4256
advisories.mageia.org/MGASA-2013-0298.html
lists.fedoraproject.org/pipermail/package-announce/2013-September/117049.html
bugs.mageia.org/show_bug.cgi?id=11305