REDHAT-BUG-1066761: Buffer Overflow
Pierre Carrier reported a stack-based buffer overflow flaw in the FreeRADIUS rlmpap module. An authenticated user could trigger this issue by creating a large password, causing FreeRADIUS to crash. The stack protector and SSP variable re-ordering protections should help prevent this issue from being used to execute arbitrary code.
Upstream fixes: 2.x: https://github.com/FreeRADIUS/freeradius-server/commit/0d606cfc29a 3.x: https://github.com/FreeRADIUS/freeradius-server/commit/ff5147c9e5088c7 master: https://github.com/FreeRADIUS/freeradius-server/commit/f610864d4c8f51d
References: http://lists.freebsd.org/pipermail/freebsd-bugbusters/2014-February/000610.html
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1066761?
The vulnerability REDHAT-BUG-1066761 is considered high severity due to the potential for a stack-based buffer overflow leading to crashes.
How do I fix REDHAT-BUG-1066761?
To fix REDHAT-BUG-1066761, update FreeRADIUS to the latest version that addresses this buffer overflow flaw.
Who is affected by REDHAT-BUG-1066761?
Authenticated users of FreeRADIUS versions 2.x and 3.x are at risk of triggering the stack-based buffer overflow in REDHAT-BUG-1066761.
What module in FreeRADIUS is impacted by REDHAT-BUG-1066761?
The rlm_pap module in FreeRADIUS is specifically impacted by the vulnerability REDHAT-BUG-1066761.
What are the potential consequences of REDHAT-BUG-1066761?
The potential consequences of REDHAT-BUG-1066761 include application crashes and possible service disruption.