RADIUS: Format String Injection

This signature detects attempts to exploit a known vulnerability in GNU Radius 1.2 and 1.3. A successful attack can lead to a Format string injection and arbitrary remote code execution within the context of the server.

Extended Description

GNU Radius is prone to a remote format-string vulnerability because the application fails to properly sanitize user-supplied input before including it in the format-specifier argument of a formatted-printing function. Successfully exploiting this issue allows remote attackers to execute arbitrary code with superuser privileges, since the daemon typically runs with elevated privileges. This facitates the complete compromise of affected computers. GNU Radius versions 1.2 and 1.3 are vulnerable to this issue; other versions may also be affected.

Affected Products

Gnu radius

Short Name
RADIUS:FS-INJ
Severity
Major
Recommended
False
Recommended Action
Drop Packet
Category
RADIUS
Keywords
CVE-2006-4181 Format Injection String bid:21303
Release Date
11/30/2006
Supported Platforms

srx-branch-12.3

srx-19.3

srx-branch-19.3

vsrx3bsd-19.2

srx-branch-19.4

vsrx-19.4

mx-12.3

mx-19.4

vmx-19.4

mx-19.3

vsrx3bsd-19.4

srx-19.4

vsrx-12.3

vmx-19.3

vsrx-19.2

srx-12.3

Sigpack Version
3728
False Positive
Unknown
Vendors

Gentoo

Gnu

CVSS Score

10.0

Found a potential security threat?