OpenBSD VuXML: Documenting security issues in the OpenBSD Ports & Packages Collection

mod_auth_radius -- remote integer overflow

Affected packages
mod_auth_radius < 1.5.7p0

Details

VuXML ID 3f170d64-84c9-11d9-bc42-00065bd5b0b6
Discovery 2005-01-10
Entry 2005-01-24

When mod_auth_radius authenticates user against remote RADIUS server, it will send RADIUS packet with RADIUS_ACCESS_REQUEST code. Server can respond with RADIUS packet with RADIUS_ACCESS_CHALLENGE code. When mod_auth_radius gets RADIUS_ACCESS_CHALLENGE with attribute code set to RADIUS_STATE and another attribute code in same packet set to RADIUS_REPLY_MESSAGE, RADIUS server reply will be copied in the local buffer with function radcpy(). Size of the data to be copied in local buffer is taken from 'length' value of the packet attribute received from RADIUS server.

References

URL http://security.lss.hr/en/index.php?page=details&ID=LSS-2005-01-02