SQL injection vulnerability in the radius_xlat function in the SQL module for FreeRADIUS 1.0.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via (1) group_membership_query, (2) simul_count_query, or (3) simul_verify_query configuration entries.

The freeradius development team reports :

A malicious 802.1x supplicant could send malformed Diameter format attributes inside of an EAP-TTLS tunnel. The server would reject the authentication request, but would leak one VALUE_PAIR data structure, of approximately 300 bytes. If an attacker performed the attack many times (e.g. thousands or more over a period of minutes to hours), the server could leak megabytes of memory, potentially leading to an 'out of memory' condition, and early process exit.

Updated freeradius packages that fix a buffer overflow and possible SQL injection attacks in the sql module are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

FreeRADIUS is a high-performance and highly configurable free RADIUS server designed to allow centralized authentication and authorization for a network.

A buffer overflow bug was found in the way FreeRADIUS escapes data in a SQL query. An attacker may be able to crash FreeRADIUS if they cause FreeRADIUS to escape a string containing three or less characters. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1454 to this issue.

Additionally a bug was found in the way FreeRADIUS escapes SQL data.
It is possible that an authenticated user could execute arbitrary SQL queries by sending a specially crafted request to FreeRADIUS. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1455 to this issue.

Users of FreeRADIUS should update to these erratum packages, which contain backported patches and are not vulnerable to these issues.

A Gentoo Advisory reports :

The FreeRADIUS server is vulnerable to a SQL injection attack and a buffer overflow, possibly resulting in disclosure and modification of data and Denial of Service.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:524 advisory.

  - security flaw (CVE-2005-1454, CVE-2005-1455)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-200505-13 (FreeRADIUS: SQL injection and Denial of Service vulnerability)

    Primoz Bratanic discovered that the sql_escape_func function of     FreeRADIUS may be vulnerable to a buffer overflow (BID 13541). He also     discovered that FreeRADIUS fails to sanitize user-input before using it     in a SQL query, possibly allowing SQL command injection (BID 13540).
  Impact :

    By supplying carefully crafted input, a malicious user could cause an     SQL injection or a buffer overflow, possibly leading to the disclosure     and the modification of sensitive data or Denial of Service by crashing     the server.
  Workaround :

    There are no known workarounds at this time.

ID	Name	Product	Family	Severity
25051	FreeBSD : freeradius -- EAP-TTLS Tunnel Memory Leak Remote DOS Vulnerability (c110eda2-e995-11db-a944-0012f06707f0)	Nessus	FreeBSD Local Security Checks	high
21837	CentOS 3 / 4 : freeradius (CESA-2005:524)	Nessus	CentOS Local Security Checks	high
18891	FreeBSD : freeradius -- sql injection and denial of service vulnerability (2fbe16c2-cab6-11d9-9aed-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	high
18557	RHEL 4 : freeradius (RHSA-2005:524)	Nessus	Red Hat Local Security Checks	high
18272	GLSA-200505-13 : FreeRADIUS: SQL injection and Denial of Service vulnerability	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2005-1454

high

Tenable Plugins

high

high

high

high

high