SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Security)  >   RADIUS (GNU) Vendors:   GNU [multiple authors]
GNU RADIUS 'sqllog' Format String Flaw Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1017285
SecurityTracker URL:  http://securitytracker.com/id/1017285
CVE Reference:   CVE-2006-4181   (Links to External Site)
Date:  Nov 27 2006
Impact:   Execution of arbitrary code via network, Root access via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 1.2, 1.3, possibly other versions
Description:   A vulnerability was reported in RADIUS (GNU). A remote user can execute arbitrary code on the target system.

A remote user can send specially crafted data to trigger a format string flaw and execute arbitrary code on the target system. The code will run with the privileges of the target radiusd service. The radius daemon runs with root privileges on some systems.

The vulnerability resides within the SQL accounting code. A specially crafted 'sqllog' value can trigger the vulnerability.

The vendor was notified on August 16, 2006.

Impact:   A remote user can execute arbitrary code on the target system.
Solution:   The vendor has issued a fixed version (1.4).
Vendor URL:  www.gnu.org/software/radius/radius.html (Links to External Site)
Cause:   Input validation error, State error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   None.


 Source Message Contents

Subject:  [Full-disclosure] iDefense Security Advisory 11.26.06: GNU Radius

GNU Radius Format String Vulnerability

iDefense Security Advisory 11.26.06
http://labs.idefense.com/intelligence/vulnerabilities/
Nov 26, 2006

I. BACKGROUND

GNU Radius is a centralized user authentication and accounting system. It
supports back-end SQL databases for accounting. More information can be
found at http://www.gnu.org/software/radius/

II. DESCRIPTION

Remote exploitation of a format string vulnerability in GNU Radius could
allow an attacker to execute code in the context of the running daemon.

The vulnerability specifically exists within the SQL accounting code. A
format string is built using user supplied data and then unsafely passed
to the variable argument function 'sqllog'.

III. ANALYSIS

Successful exploitation allows unauthenticated remote attackers to execute
arbitrary code in the context of the running radius daemon (radiusd).
Typically the radius daemon will run as root.

Exploitation requires that radiusd be compiled with an SQL back-end and
SQL accounting be turned on. These options are both turned on by default
for FreeBSD and Gentoo Linux.

IV. DETECTION

iDefense has confirmed that this vulnerability is present in version 1.3
and 1.2 of GNU Radius. It is likely that all prior versions are
vulnerable.

V. WORKAROUND

iDefense confirms that using one of the other supported accounting methods
will mitigate exploitation of this vulnerability while still allowing
accounting to take place.

VI. VENDOR RESPONSE

The GNU Radius team included a fix for this vulnerability in version 1.4.

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2006-4181 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems.

VIII. DISCLOSURE TIMELINE

08/16/2006  Initial vendor notification
09/08/2006  Initial vendor response
11/06/2006  Second vendor notification
11/26/2006  Coordinated public disclosure

IX. CREDIT

The discoverer of this vulnerability wishes to remain anonymous.

Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php

Free tools, research and upcoming events
http://labs.idefense.com/

X. LEGAL NOTICES


Permission is granted for the redistribution of this alert electronically.
It may not be edited in any way without the express written consent of
iDefense. If you wish to reprint the whole or any part of this alert in
any other medium other than electronically, please e-mail
customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate at
the time of publishing based on currently available information. Use of
the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on, this
information.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC