PT-2004-1044 · Debian · Yard Radius

Max Vozeler · Published 2004-12-05 · Updated 2018-10-30 · CVE-2004-0987

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions yardradius version 1.0.20

Description The issue affects the yardradius package in Debian GNU/Linux, potentially leading to breaches in confidentiality, integrity, and availability of protected information. It can be exploited remotely. A buffer overflow in the process menu function allows remote attackers to execute arbitrary code.

Recommendations For yardradius version 1.0.20, consider disabling the process menu function as a temporary workaround until a patch is available. Restrict access to the yardradius package to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2015-04098

CVE-2004-0987

DSA-598-1

Affected Products

Yard Radius

References · 8

• http://debian.org/security/2004/dsa-598 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0987 · Security Note
• https://bdu.fstec.ru/vul/2015-04098 · Security Note
• http://securityfocus.com/bid/11753 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0987 · Security Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278384 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18270 · Note
• http://debian.org/security/dsa-598 · Note