Public Vulnerability Reports

GNU Radius Format String Vulnerability

11.26.06

BACKGROUND

GNU Radius is a centralized user authentication and accounting system. It supports back-end SQL databases for accounting. More information can be found at http://www.gnu.org/software/radius/

DESCRIPTION

Remote exploitation of a format string vulnerability in GNU Radius could allow an attacker to execute code in the context of the running daemon.

The vulnerability specifically exists within the SQL accounting code. A format string is built using user supplied data and then unsafely passed to the variable argument function 'sqllog'.

ANALYSIS

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code in the context of the running radius daemon (radiusd). Typically the radius daemon will run as root.

Exploitation requires that radiusd be compiled with an SQL back-end and SQL accounting be turned on. These options are both turned on by default for FreeBSD and Gentoo Linux.

DETECTION

iDefense has confirmed that this vulnerability is present in version 1.3 and 1.2 of GNU Radius. It is likely that all prior versions are vulnerable.

WORKAROUND

iDefense confirms that using one of the other supported accounting methods will mitigate exploitation of this vulnerability while still allowing accounting to take place.

VENDOR RESPONSE

The GNU Radius team included a fix for this vulnerability in version 1.4.

CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2006-4181 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems.

DISCLOSURE TIMELINE

08/16/2006 Initial vendor notification
09/08/2006 Initial vendor response
11/06/2006 Second vendor notification
11/26/2006 Coordinated public disclosure

CREDIT

The discoverer of this vulnerability wishes to remain anonymous.

Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php

Free tools, research and upcoming events
http://labs.idefense.com/

LEGAL NOTICES

Copyright © 2006 Verisign, Inc.

Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDefense. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please e-mail customer service for permission.

Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.