PT-2014-4431 · Freeradius+4 · Freeradius+4

Published 2014-02-21 · Updated 2024-06-15 · CVE-2014-2015

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FreeRADIUS versions 2.x through 2.2.3 and earlier FreeRADIUS versions 3.x through 3.0.1 and earlier

Description The issue is related to a stack-based buffer overflow in the normify function within the rlm pap module. This could potentially allow attackers to cause a denial of service, leading to a crash, and possibly execute arbitrary code. The attack vector involves a long password hash, such as an SSHA hash.

Recommendations For FreeRADIUS versions 2.x through 2.2.3 and earlier, consider updating to a version later than 2.2.3 to resolve the issue. For FreeRADIUS versions 3.x through 3.0.1 and earlier, consider updating to a version later than 3.0.1 to resolve the issue. As a temporary workaround, consider restricting the length of password hashes to prevent exploitation until a patch is available.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2016-1003

CESA-2015_1287

CVE-2014-2015

DLA-977-1

MGASA-2014-0088

OPENSUSE-SU-2024:10053-1

RHSA-2015:1287

RHSA-2015_1287

SUSE-SU-2014_0525-1

Affected Products

Alt Linux

Centos

Freeradius

Red Hat

Suse

References · 36

• 🔥 http://lists.freebsd.org/pipermail/freebsd-bugbusters/2014-February/000610.html · Exploit
• http://openwall.com/lists/oss-security/2014/02/18/3 · Patch
• https://errata.altlinux.org/ALT-PU-2016-1003 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0088.html · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-1287.html · Vendor Advisory
• http://ubuntu.com/usn/usn-2122-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-2015 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-2015 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2015-1287.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4966 · Security Note
• https://osv.dev/vulnerability/CVE-2014-2015 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2015 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0088 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-2015 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4680 · Security Note