CVE-2015-9542 add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could s...
HighCVSS 7.5
EPSS 3.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a crafted password to an application (loading the pam_radius library) and crash it. Arbitrary code execution might be possible, depending on the application, C library, compiler, and other factors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libpam-radius-auth(Debian:12) | < 1.4.0-3 | 1.4.0-3 |
| debian/libpam-radius-auth(Debian:13) | < 1.4.0-3 | 1.4.0-3 |
| debian/libpam-radius-auth(Debian:14) | < 1.4.0-3 | 1.4.0-3 |
| freeradius pam radius | = 1.4.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| Canonical Ubuntu Linux | = 19.10 | No fix listed |
References
- Debian Security Tracker CVE-2015-9542 vendor-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- github.com patch third-party-advisory
- [debian-lts-announce] 20200222 [SECURITY] [DLA 2116-1] libpam-radius-auth security update mailing-list third-party-advisory
- [debian-lts-announce] 20200801 [SECURITY] [DLA 2304-1] libpam-radius-auth security update mailing-list third-party-advisory
- USN-4290-1 third-party-advisory vendor-advisory
- USN-4290-2 third-party-advisory vendor-advisory
- bugs.debian.org issue-tracking