Out-of-bounds write in pam_radius and Debian Linux - CVE-2015-9542

Vulnerability identifier: #VU34810

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2015-9542

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a crafted password to an application (loading the pam_radius library) and crash it. Arbitrary code execution might be possible, depending on the application, C library, compiler, and other factors.

pam_radius
Debian Linux
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Server
SUSE CaaS Platform
Fedora
SUSE Enterprise Storage
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Linux Enterprise Module for Server Applications
pam_radius
pam_radius-debuginfo
pam_radius-debugsource

Install update from vendor's website.

pam_radius - update to 1.4.0-3.3.1
pam_radius-debuginfo - update to 1.4.0-3.3.1
pam_radius-debugsource - update to 1.4.0-3.3.1
pam_radius - update to 1.4.0-4.el6

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-9542
• https://github.com/FreeRADIUS/pam_radius/commit/01173ec2426627dbb1e0d96c06c3ffa0b14d36d0
• https://lists.debian.org/debian-lts-announce/2020/02/msg00023.html
• https://lists.debian.org/debian-lts-announce/2020/08/msg00000.html
• https://usn.ubuntu.com/4290-1/
• https://usn.ubuntu.com/4290-2/

• Out-of-bounds write in FreeRADIUS pam_radius
• SUSE update for pam_radius
• Fedora EPEL 6 update for pam_radius