Format string vulnerabilities in Livingston/Lucent RADIUS before 2.1.va.1 may allow local or remote attackers to cause a denial of service and possibly execute arbitrary code via format specifiers that are injected into log messages.
http://www.securityfocus.com/bid/2994
http://freshmeat.net/releases/52020/
http://archives.neohapsis.com/archives/vulnwatch/2001-q3/0005.html
http://archives.neohapsis.com/archives/apps/freshmeat/2001-07/0009.html