Red Hat Security Advisory 2015-1287-01 - FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service server, designed to allow centralized authentication and authorization for a network. A stack-based buffer overflow was found in the way the FreeRADIUS rlm_pap module handled long password hashes. An attacker able to make radiusd process a malformed password hash could cause the daemon to crash. The freeradius packages have been upgraded to upstream version 2.2.6, which provides a number of bug fixes and enhancements over the previous version.
fff0889efd9c4efb715a9ebd610f56cf82b6e6c7c64de811570484fbdb6d13bbGentoo Linux Security Advisory 201406-12 - A vulnerability in FreeRADIUS can lead to arbitrary code execution or Denial of Service by authenticated users. Versions less than 2.2.5 are affected.
010ad86173718670617073a898022afc8bae419c0a34107d6a83d1dc5cd8e6c5Mandriva Linux Security Advisory 2014-058 - SSHA processing in freeradius before 2.2.3 runs into a stack-based buffer overflow in the freeradius rlm_pap module if the password source uses an unusually long hashed password.
4abd4790fbbfe3df3a6955b9c9a46d812e0b17d035f4299001798f8b1b631ef1Ubuntu Security Notice 2122-1 - It was discovered that FreeRADIUS incorrectly handled unix authentication. A remote user could successfully authenticate with an expired password. Pierre Carrier discovered that FreeRADIUS incorrectly handled rlm_pap hash processing. An authenticated user could use this issue to cause FreeRADIUS to crash, resulting in a denial of service, or possibly execute arbitrary code. The default compiler options for affected releases should reduce the vulnerability to a denial of service. Various other issues were also addressed.
0a995469005a5d9cd6cf4dd533400746453f53f7672a93339e2f298e285126ef
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed