PT-2015-7849 · Linux Pam+2 · Pam Radius+2
Laura Pardo
·
Published
2015-12-31
·
Updated
2021-07-11
·
CVE-2015-9542
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
pam radius version 1.4.0
Description
The issue arises from the
add password function in pam radius auth.c, which fails to correctly check the length of the input password. This oversight makes it vulnerable to a stack-based buffer overflow during the memcpy() operation. An attacker could exploit this by sending a crafted password to an application that loads the pam radius library, potentially crashing the application. Depending on various factors such as the application, C library, compiler, and other environmental elements, arbitrary code execution might be feasible.Recommendations
For pam radius version 1.4.0, consider updating to a newer version that addresses this issue, as the current version is susceptible to a stack-based buffer overflow. As a temporary workaround, consider restricting the use of the
add password function in pam radius auth.c to minimize the risk of exploitation. Additionally, be cautious when handling input passwords to prevent potential crashes or arbitrary code execution.Fix
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Suse
Ubuntu
Pam Radius