[UNIX] GNU Radius SNMP String Length Integer Overflow DoS

From: SecuriTeam (support_at_securiteam.com)
Date: 09/21/04

  • Next message: SecuriTeam: "[EXPL] Buffer Overrun in JPEG Processing Proof Of Concept (MS04-028)" 
    To: list@securiteam.com
Date: 21 Sep 2004 13:56:14 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      GNU Radius SNMP String Length Integer Overflow DoS
    ------------------------------------------------------------------------

    SUMMARY

    " <http://www.gnu.org/software/radius/radius.html> Radius is a server for
    remote user authentication and accounting. Its primary use is for Internet
    Service Providers, though it may as well be used on any network that needs
    a centralized authentication and/or accounting service for its
    workstations."

    Remote exploitation of an input validation error in radiusd could allow a
    denial of service.

    DETAILS

    Vulnerable Systems:
     * GNU Radius server versions 1.1 and 1.2

    Immune Systems:
     * GNU Radius server version 1.2.94

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0849>
    CAN-2004-0849

    The problem exists in an ASN decoding routine in the Radius server code.
    The function is asn_decode_string() which is defined in snmplib/asn1.c .
    When a very large unsigned number is supplied, it is possible that an
    integer overflow will occur in the bounds-checking code. The daemon will
    then attempt to reference unallocated memory, resulting in an access
    violation that causes the process to terminate.

    Impact:
    Successful exploitation allows unauthenticated remote attackers to cause
    the radius daemon (radiusd) to crash. This thereby prevents legitimate
    users from accessing systems reliant upon the affected radius server for
    authentication. This vulnerability does not seem to allow for execution of
    code. It is a denial of service condition only. Exploitation requires that
    radiusd be compiled with the --enable-snmp option. SNMP support is not
    enabled in the default build procedure.

    Workaround
    Disable SNMP support when building radiusd at compile time. Ingress
    filtering of UDP port 161 on all interfaces that should not be receiving
    SNMP packets may lessen exposure to this vulnerability in affected
    environments.

    Vendor Status:
    The vulnerability is already fixed in a newer, maintenance release
    version. Users are highly encouraged to upgrade to an immune version.

    Disclosure Timeline
    09/10/2004 Initial vendor notification
    09/10/2004 Initial vendor response
    09/15/2004 Public disclosure

    ADDITIONAL INFORMATION

    The information has been provided by
    <mailto:idlabs-advisories@idefense.com> iDEFENSE Security Labs.
    The original article can be found at:
    <http://www.idefense.com/application/poi/display?id=141&type=vulnerabilities> http://www.idefense.com/application/poi/display?id=141&type=vulnerabilities

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[EXPL] Buffer Overrun in JPEG Processing Proof Of Concept (MS04-028)"

    Relevant Pages