156376 2006-11-26 23:32 0000 net-dialup/gnuradius format string vulnerability (CVE-2006-4181) 2006-12-15 07:56:26 0000 1 1 1 Unclassified Gentoo Security Vulnerabilities unspecified All Linux RESOLVED FIXED http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=443 B1? [glsa] jaervosz P2 major --- 1 jaervosz@gentoo.org security@gentoo.org net-dialup@gentoo.org jaervosz@gentoo.org 2006-11-26 23:32:46 0000 GNU Radius Format String Vulnerability I. BACKGROUND GNU Radius is a centralized user authentication and accounting system. It supports back-end SQL databases for accounting. More information can be found at http://www.gnu.org/software/radius/ II. DESCRIPTION Remote exploitation of a format string vulnerability in GNU Radius could allow an attacker to execute code in the context of the running daemon. The vulnerability specifically exists within the SQL accounting code. A format string is built using user supplied data and then unsafely passed to the variable argument function 'sqllog'. III. ANALYSIS Successful exploitation allows unauthenticated remote attackers to execute arbitrary code in the context of the running radius daemon (radiusd). Typically the radius daemon will run as root. Exploitation requires that radiusd be compiled with an SQL back-end and SQL accounting be turned on. These options are both turned on by default for FreeBSD and Gentoo Linux. IV. DETECTION iDefense has confirmed that this vulnerability is present in version 1.3 and 1.2 of GNU Radius. It is likely that all prior versions are vulnerable. V. WORKAROUND iDefense confirms that using one of the other supported accounting methods will mitigate exploitation of this vulnerability while still allowing accounting to take place. VI. VENDOR RESPONSE The GNU Radius team included a fix for this vulnerability in version 1.4. VII. CVE INFORMATION The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2006-4181 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. VIII. DISCLOSURE TIMELINE 08/16/2006 Initial vendor notification 09/08/2006 Initial vendor response 11/06/2006 Second vendor notification 11/26/2006 Coordinated public disclosure IX. CREDIT The discoverer of this vulnerability wishes to remain anonymous. Get paid for vulnerability research http://labs.idefense.com/methodology/vulnerability/vcp.php Free tools, research and upcoming events http://labs.idefense.com/ X. LEGAL NOTICES Copyright jaervosz@gentoo.org 2006-11-26 23:32:46 0000 GNU Radius Format String Vulnerability I. BACKGROUND GNU Radius is a centralized user authentication and accounting system. It supports back-end SQL databases for accounting. More information can be found at http://www.gnu.org/software/radius/ II. DESCRIPTION Remote exploitation of a format string vulnerability in GNU Radius could allow an attacker to execute code in the context of the running daemon. The vulnerability specifically exists within the SQL accounting code. A format string is built using user supplied data and then unsafely passed to the variable argument function 'sqllog'. III. ANALYSIS Successful exploitation allows unauthenticated remote attackers to execute arbitrary code in the context of the running radius daemon (radiusd). Typically the radius daemon will run as root. Exploitation requires that radiusd be compiled with an SQL back-end and SQL accounting be turned on. These options are both turned on by default for FreeBSD and Gentoo Linux. IV. DETECTION iDefense has confirmed that this vulnerability is present in version 1.3 and 1.2 of GNU Radius. It is likely that all prior versions are vulnerable. V. WORKAROUND iDefense confirms that using one of the other supported accounting methods will mitigate exploitation of this vulnerability while still allowing accounting to take place. VI. VENDOR RESPONSE The GNU Radius team included a fix for this vulnerability in version 1.4. VII. CVE INFORMATION The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2006-4181 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. VIII. DISCLOSURE TIMELINE 08/16/2006 Initial vendor notification 09/08/2006 Initial vendor response 11/06/2006 Second vendor notification 11/26/2006 Coordinated public disclosure IX. CREDIT The discoverer of this vulnerability wishes to remain anonymous. Get paid for vulnerability research http://labs.idefense.com/methodology/vulnerability/vcp.php Free tools, research and upcoming events http://labs.idefense.com/ X. LEGAL NOTICES Copyright © 2006 iDefense, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDefense. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please e-mail customer service for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information. jaervosz@gentoo.org 2006-11-26 23:33:47 0000 net-dialup please advise and bump as necessary. dercorny@gentoo.org 2006-11-27 00:40:39 0000 i guess SQL support is a useflag? is SQL accounting enabled by default? mrness@gentoo.org 2006-11-27 10:22:42 0000 Version bumped and marked stable on x86 (the only keyword btw). (In reply to comment #2) > i guess SQL support is a useflag? is SQL accounting enabled by default? yes and yes. However, we do not provide a init script for radius daemon. dercorny@gentoo.org 2006-11-27 12:42:59 0000 does this really run with root privs like stated in the advisory? If so, this should be changed before sending a GLSA. mrness@gentoo.org 2006-11-27 14:51:40 0000 Created an attachment (id=102869) sqllog changes The attachement describe changes occured in sqllog(). Since we don't provide a init script, I cannot say anything about this subject. The user decides under which privileges will run radius daemon, not us. The fact that we don't provide a init script speak for itself: there aren't many gnuradius users. Most RADIUS peeps use freeradius (me included). sqllog function has no longer a variable list of arguments. Since all calls to that function had only the 2 mandatory arguments, I can only conclude that va_start can be exploited through a carefully chosen msg. jaervosz@gentoo.org 2006-12-11 08:16:42 0000 This one is ready for GLSA release. Sorry for the delay:-( falco@gentoo.org 2006-12-15 07:56:26 0000 GLSA 200612-17 102869 2006-11-27 14:51 0000 sqllog changes sqllog.patch text/plain QEAgLTQwOSwxNyArMzk5LDE1IEBACiAvKiBJbnRlcmZhY2UgKi8KIAogI2lmZGVmIFVTRV9TUUwK LS8qUFJJTlRGTElLRTIqLwogdm9pZAotc3FsbG9nKGludCBzdGF0dXMsIGNoYXIgKm1zZywgLi4u KQorc3FsbG9nKGludCBzdGF0dXMsIGNoYXIgKnF1ZXJ5KQogewotICAgICAgICB2YV9saXN0IGFw OwogICAgICAgICBGSUxFICpmcDsKICAgICAgICAgY2hhciAqcGF0aDsKICAgICAgICAgY2hhciAq ZmlsZW5hbWU7CiAKICAgICAgICAgZmlsZW5hbWUgPSBzdGF0dXMgPyAic3FsLWxvc3QiIDogInNx bC5sb2ciOwotICAgICAgICBwYXRoID0gZ3JhZF9ta2ZpbGVuYW1lKHJhZGFjY3RfZGlyLCBmaWxl bmFtZSk7CisgICAgICAgIHBhdGggPSBncmFkX21rZmlsZW5hbWUoZ3JhZF9hY2N0X2RpciwgZmls ZW5hbWUpOwogICAgICAgICBpZiAoKGZwID0gZm9wZW4ocGF0aCwgImEiKSkgPT0gTlVMTCkgewog ICAgICAgICAgICAgICAgIGdyYWRfbG9nKExfRVJSfExfUEVSUk9SLCAgCiAgICAgICAgICAgICAg ICAgICAgICAgICAgXygiY291bGQgbm90IGFwcGVuZCB0byBmaWxlICVzIiksIHBhdGgpOwpAQCAt NDI3LDEwICs0MTUsNyBAQAogICAgICAgICAgICAgICAgIHJldHVybjsKICAgICAgICAgfQogICAg ICAgICBncmFkX2ZyZWUocGF0aCk7Ci0JdmFfc3RhcnQoYXAsIG1zZyk7Ci0gICAgICAgIHZmcHJp bnRmKGZwLCBtc2csIGFwKTsKLSAgICAgICAgZnByaW50ZihmcCwgIjtcbiIpOwotICAgICAgICB2 YV9lbmQoYXApOworICAgICAgICBmcHJpbnRmKGZwLCAiJXM7XG4iLCBxdWVyeSk7CiAgICAgICAg IGZjbG9zZShmcCk7CiB9CiAjZW5kaWYK