PT-2005-2450 · Freeradius+1 · Freeradius+1

Primoz Bratanic · Publicado 2005-05-19 · Atualizado 2017-10-11 · CVE-2005-1454

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: FreeRADIUS versions 1.0.2 and earlier

Description: The issue allows remote authenticated users to execute arbitrary SQL commands via specific configuration entries, including group membership query, simul count query, or simul verify query. This is due to a SQL injection vulnerability in the radius xlat function within the SQL module.

Recommendations: For FreeRADIUS versions 1.0.2 and earlier, consider restricting access to the SQL module or disabling the radius xlat function as a temporary workaround until a patch is available. Avoid using the group membership query, simul count query, or simul verify query configuration entries in the affected API endpoints until the issue is resolved.

Correção

Identificadores relacionados

CVE-2005-1454

RHSA-2005:524

RHSA-2005_524

Produtos afetados

Freeradius

Red Hat

Referências · 16

• https://exchange.xforce.ibmcloud.com/vulnerabilities/20449 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9610 · Nota
• http://securitytracker.com/alerts/2005/May/1013909.html · Nota
• https://redhat.com/security/data/cve/CVE-2005-1455.html · Nota
• http://securityfocus.com/bid/13540 · Correção
• http://freeradius.org/security.html · Nota
• https://security-tracker.debian.org/tracker/CVE-2005-1454 · Aviso do Fabricante
• https://rhn.redhat.com/errata/RHSA-2005-524.html · Nota
• http://derkeiler.com/Mailing-Lists/Full-Disclosure/2005-05/0492.html · Nota
• http://gentoo.org/security/en/glsa/glsa-200505-13.xml · Correção, Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-1454 · Aviso do Fabricante
• https://redhat.com/security/data/cve/CVE-2005-1454.html · Nota
• http://novell.com/linux/security/advisories/2005_14_sr.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-1454 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2005-1454 · Aviso do Fabricante