PT-2005-2450 · Freeradius+1 · Freeradius+1

Primoz Bratanic · Published 2005-05-19 · Updated 2017-10-11 · CVE-2005-1454

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: FreeRADIUS versions 1.0.2 and earlier

Description: The issue allows remote authenticated users to execute arbitrary SQL commands via specific configuration entries, including group membership query, simul count query, or simul verify query. This is due to a SQL injection vulnerability in the radius xlat function within the SQL module.

Recommendations: For FreeRADIUS versions 1.0.2 and earlier, consider restricting access to the SQL module or disabling the radius xlat function as a temporary workaround until a patch is available. Avoid using the group membership query, simul count query, or simul verify query configuration entries in the affected API endpoints until the issue is resolved.

Fix

Related Identifiers

CVE-2005-1454

RHSA-2005:524

RHSA-2005_524

Affected Products

Freeradius

Red Hat

References · 16

• http://securityfocus.com/bid/13540 · Patch
• https://security-tracker.debian.org/tracker/CVE-2005-1454 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-1454 · Vendor Advisory
• http://novell.com/linux/security/advisories/2005_14_sr.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-1454 · Security Note
• https://osv.dev/vulnerability/CVE-2005-1454 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-524.html · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20449 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9610 · Note
• http://securitytracker.com/alerts/2005/May/1013909.html · Note
• https://redhat.com/security/data/cve/CVE-2005-1455.html · Note
• http://freeradius.org/security.html · Note
• https://rhn.redhat.com/errata/RHSA-2005-524.html · Note
• http://derkeiler.com/Mailing-Lists/Full-Disclosure/2005-05/0492.html · Note
• http://gentoo.org/security/en/glsa/glsa-200505-13.xml · Patch, Vendor Advisory