CVE-2014-2015: Buffer Overflow
Pierre Carrier reported a stack-based buffer overflow flaw in the FreeRADIUS rlmpap module. An authenticated user could trigger this issue by creating a large password, causing FreeRADIUS to crash. The stack protector and SSP variable re-ordering protections should help prevent this issue from being used to execute arbitrary code.
Upstream fixes: 2.x: https://github.com/FreeRADIUS/freeradius-server/commit/0d606cfc29a 3.x: https://github.com/FreeRADIUS/freeradius-server/commit/ff5147c9e5088c7 master: https://github.com/FreeRADIUS/freeradius-server/commit/f610864d4c8f51d
References: http://lists.freebsd.org/pipermail/freebsd-bugbusters/2014-February/000610.html
Other sources
Stack-based buffer overflow in the normify function in the rlmpap module (modules/rlmpap/rlmpap.c) in FreeRADIUS 2.x, possibly 2.2.3 and earlier, and 3.x, possibly 3.0.1 and earlier, might allow attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long password hash, as demonstrated by an SSHA hash.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2015?
CVE-2014-2015 is classified as a medium severity vulnerability due to its potential impact on service availability.
How do I fix CVE-2014-2015?
To mitigate CVE-2014-2015, users should upgrade FreeRADIUS to a patched version above 2.0.5 or apply appropriate workarounds to limit password size.
Who is affected by CVE-2014-2015?
CVE-2014-2015 affects FreeRADIUS versions from 2.0 to 3.0.1 that use the rlm_pap module.
What kind of attack can exploit CVE-2014-2015?
CVE-2014-2015 can be exploited by an authenticated user who deliberately provides an oversized password to crash the FreeRADIUS server.
Is CVE-2014-2015 already exploited in the wild?
As of the last update, there have been no confirmed public exploits targeting CVE-2014-2015 in the wild.