FreeRadius RLM_SQL.C Buffer Overflow Vulnerability
BID:13541
Info
FreeRadius RLM_SQL.C Buffer Overflow Vulnerability
| Bugtraq ID: | 13541 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2005-1455 |
| Remote: | Yes |
| Local: | No |
| Published: | May 06 2005 12:00AM |
| Updated: | Jul 12 2009 02:06PM |
| Credit: | Primoz Bratanic is credited with the discovery of this vulnerability. |
| Vulnerable: |
SuSE SUSE Linux Enterprise Server 8 SuSE SUSE Linux Enterprise Server 7 SuSE Linux Openexchange Server SuSE Linux Enterprise Server 9 SuSE Linux Desktop 1.0 SuSE Linux 8.1 SuSE Linux 8.0 i386 SuSE Linux 8.0 SuSE Linux 7.3 sparc SuSE Linux 7.3 ppc SuSE Linux 7.3 i386 SuSE Linux 7.3 SuSE Linux 7.2 i386 SuSE Linux 7.2 SuSE Linux 7.1 x86 SuSE Linux 7.1 sparc SuSE Linux 7.1 ppc SuSE Linux 7.1 alpha SuSE Linux 7.1 SuSE Linux 7.0 sparc SuSE Linux 7.0 ppc SuSE Linux 7.0 i386 SuSE Linux 7.0 alpha SuSE Linux 7.0 SuSE Linux 6.4 ppc SuSE Linux 6.4 i386 SuSE Linux 6.4 alpha SuSE Linux 6.4 SuSE Linux 6.3 ppc SuSE Linux 6.3 alpha SuSE Linux 6.3 SuSE Linux 6.2 SuSE Linux 6.1 alpha SuSE Linux 6.1 SuSE Linux 6.0 SuSE Linux 5.3 SuSE Linux 5.2 SuSE Linux 5.1 SuSE Linux 5.0 SuSE Linux 4.4.1 SuSE Linux 4.4 SuSE Linux 4.3 SuSE Linux 4.2 SuSE Linux 4.0 SuSE Linux 3.0 SuSE Linux 2.0 SuSE Linux 1.0 SGI ProPack 3.0 SP5 S.u.S.E. SuSE Linux School Server for i386 S.u.S.E. SuSE eMail Server III S.u.S.E. SuSE eMail Server 3.1 S.u.S.E. Open-Enterprise-Server 9.0 S.u.S.E. Novell Linux Desktop 9.0 S.u.S.E. Novell Linux Desktop 1.0 S.u.S.E. Linux Professional 8.2 S.u.S.E. Linux Professional 7.3 S.u.S.E. Linux Personal 9.3 S.u.S.E. Linux Personal 9.2 x86_64 S.u.S.E. Linux Personal 9.2 S.u.S.E. Linux Personal 9.1 x86_64 S.u.S.E. Linux Personal 9.1 S.u.S.E. Linux Personal 9.0 x86_64 S.u.S.E. Linux Personal 9.0 S.u.S.E. Linux Personal 8.2 S.u.S.E. Linux Office Server S.u.S.E. Linux IMAP Server 1.0 S.u.S.E. Linux Enterprise Server for S/390 9.0 S.u.S.E. Linux Enterprise Server for S/390 S.u.S.E. Linux Database Server 0 S.u.S.E. Linux Connectivity Server Redhat Fedora Core3 Redhat Enterprise Linux ES 4 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux AS 4 Redhat Enterprise Linux AS 3 FreeRADIUS FreeRADIUS 1.0.2 |
| Not Vulnerable: |
FreeRADIUS FreeRADIUS 1.0.3 |
Discussion
FreeRadius RLM_SQL.C Buffer Overflow Vulnerability
FreeRadius is prone to a buffer overflow vulnerability. This issue is due to a failure in the application to do proper bounds checking on user-supplied data.
Remote code execution may be possible; this has not been confirmed.
Reportedly, this issue may only result in a denial of service condition and does not allow attackers to gain unauthorized remote access.
FreeRadius is prone to a buffer overflow vulnerability. This issue is due to a failure in the application to do proper bounds checking on user-supplied data.
Remote code execution may be possible; this has not been confirmed.
Reportedly, this issue may only result in a denial of service condition and does not allow attackers to gain unauthorized remote access.
Exploit / POC
FreeRadius RLM_SQL.C Buffer Overflow Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
FreeRadius RLM_SQL.C Buffer Overflow Vulnerability
Solution:
The vendor released an update to address this issue on 03 June, 2005.
SGI has released advisory 20050606-01-U to address this, and other issues for SGI ProPack 3 Service Pack 5. Please see the referenced advisory for further information.
Debian has released updated packages to address this issue. These packages may be applied using the 'apt-get' utility.
Gentoo has released advisory GLSA 200505-13 to address this issue. Please see the referenced advisory for more information. Gentoo users may carry out the following commands to update their computers:
emerge --sync
emerge --ask --oneshot --verbose ">=net-dialup/freeradius-1.0.2-r3"
SUSE Linux has released advisory SUSE-SR:2005:014 to address this and other issues. Please see the referenced advisory for more information.
RedHat has released advisory RHSA-2005:524-05 and fixes for Enterprise Linux. Please see the referenced advisory for links to fixes.
Fedora advisory FEDORA-2005-807 is available to address this issue in Fedora Core 3.
FreeRADIUS FreeRADIUS 1.0.2
Solution:
The vendor released an update to address this issue on 03 June, 2005.
SGI has released advisory 20050606-01-U to address this, and other issues for SGI ProPack 3 Service Pack 5. Please see the referenced advisory for further information.
Debian has released updated packages to address this issue. These packages may be applied using the 'apt-get' utility.
Gentoo has released advisory GLSA 200505-13 to address this issue. Please see the referenced advisory for more information. Gentoo users may carry out the following commands to update their computers:
emerge --sync
emerge --ask --oneshot --verbose ">=net-dialup/freeradius-1.0.2-r3"
SUSE Linux has released advisory SUSE-SR:2005:014 to address this and other issues. Please see the referenced advisory for more information.
RedHat has released advisory RHSA-2005:524-05 and fixes for Enterprise Linux. Please see the referenced advisory for links to fixes.
Fedora advisory FEDORA-2005-807 is available to address this issue in Fedora Core 3.
FreeRADIUS FreeRADIUS 1.0.2
-
FreeRADIUS freeradius-1.0.3.tar.gz
ftp://ftp.freeradius.org/pub/radius/freeradius-1.0.3.tar.gz
References
FreeRadius RLM_SQL.C Buffer Overflow Vulnerability
References:
References:
- 2005.05.01 v1.0.1, v1.0.2 - Two vulnerabilities in the SQL module exist in all v (FreeRADIUS)
- FreeRADIUS Homepage (FreeRADIUS)
- Grave functionality bugs - resolved (3 bugs) (Debian)
- RHSA-2005:524-05 - freeradius security update (RedHat)