Vulnerabilities > CVE-2015-9542 - Out-Of-Bounds Write vulnerability in multiple products
add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a crafted password to an application (loading the pam_radius library) and crash it. Arbitrary code execution might be possible, depending on the application, C library, compiler, and other factors.
Common Weakness Enumeration (CWE)
NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-4290-1.NASL description It was discovered that libpam-radius-auth incorrectly handled certain long passwords. A remote attacker could possibly use this issue to cause libpam-radius-auth to crash, resulting in a denial of service. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-18 modified 2020-02-25 plugin id 134037 published 2020-02-25 reporter Ubuntu Security Notice (C) 2020 Canonical, Inc. / NASL script (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/134037 title Ubuntu 16.04 LTS / 18.04 LTS / 19.10 : libpam-radius-auth vulnerability (USN-4290-1) NASL family Debian Local Security Checks NASL id DEBIAN_DLA-2116.NASL description A vulnerability was found in pam_radius: the password length check was done incorrectly in the add_password() function in pam_radius_auth.c, resulting in a stack based buffer overflow. This could be used to crash (DoS) an application using the PAM stack for authentication. For Debian 8 last seen 2020-03-17 modified 2020-02-24 plugin id 133877 published 2020-02-24 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/133877 title Debian DLA-2116-1 : libpam-radius-auth security update NASL family SuSE Local Security Checks NASL id SUSE_SU-2020-1117-1.NASL description This update for pam_radius fixes the following issues : CVE-2015-9542: Fixed a buffer overflow in password field (bsc#1163933). On s390x didn last seen 2020-05-03 modified 2020-04-28 plugin id 136024 published 2020-04-28 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/136024 title SUSE SLES12 Security Update : pam_radius (SUSE-SU-2020:1117-1)