CVE-2014-2015

Publication date 21 February 2014

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Stack-based buffer overflow in the normify function in the rlm_pap module (modules/rlm_pap/rlm_pap.c) in FreeRADIUS 2.x, possibly 2.2.3 and earlier, and 3.x, possibly 3.0.1 and earlier, might allow attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long password hash, as demonstrated by an SSHA hash.

Status

Package Ubuntu Release Status
freeradius 13.10 saucy
Fixed 2.1.12+dfsg-1.2ubuntu5.1
12.10 quantal
Fixed 2.1.12+dfsg-1.1ubuntu0.1
12.04 LTS precise
Fixed 2.1.10+dfsg-3ubuntu0.12.04.2
10.04 LTS lucid
Fixed 2.1.8+dfsg-1ubuntu1.1

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
freeradius

References

Related Ubuntu Security Notices (USN)

    • USN-2122-1
    • FreeRADIUS vulnerabilities
    • 26 February 2014

Other references