add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a crafted password to an application (loading the pam_radius library) and crash it. Arbitrary code execution might be possible, depending on the application, C library, compiler, and other factors.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1896-1 advisory.

  - add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input     password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a     crafted password to an application (loading the pam_radius library) and crash it. Arbitrary code execution     might be possible, depending on the application, C library, compiler, and other factors. (CVE-2015-9542)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for pam_radius fixes the following issues :

  - CVE-2015-9542: pam_radius: buffer overflow in password     field (bsc#1163933)

This update was imported from the SUSE:SLE-15:Update update project.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2021:1896-1 advisory.

  - add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input     password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a     crafted password to an application (loading the pam_radius library) and crash it. Arbitrary code execution     might be possible, depending on the application, C library, compiler, and other factors. (CVE-2015-9542)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

`add_password` in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a crafted password to an application (loading the pam_radius library) and crash it. Arbitrary code execution might be possible, depending on the application, C library, compiler, and other factors.

For Debian 9 stretch, this problem has been fixed in version 1.3.16-5+deb9u1.

We recommend that you upgrade your libpam-radius-auth packages.

For the detailed security status of libpam-radius-auth please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/libpam-radius-auth

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for pam_radius fixes the following issues :

CVE-2015-9542: Fixed a buffer overflow in password field (bsc#1163933).

On s390x didn't decrypt passwords correctly (bsc#1141670).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4290-1 advisory.

    It was discovered that libpam-radius-auth incorrectly handled certain long passwords. A remote attacker     could possibly use this issue to cause libpam-radius-auth to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A vulnerability was found in pam_radius: the password length check was done incorrectly in the add_password() function in pam_radius_auth.c, resulting in a stack based buffer overflow.

This could be used to crash (DoS) an application using the PAM stack for authentication.

For Debian 8 'Jessie', this problem has been fixed in version 1.3.16-4.4+deb8u1.

We recommend that you upgrade your libpam-radius-auth packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
151683	openSUSE 15 Security Update : pam_radius (openSUSE-SU-2021:1896-1)	Nessus	SuSE Local Security Checks	high
150755	openSUSE Security Update : pam_radius (openSUSE-2021-870)	Nessus	SuSE Local Security Checks	high
150412	SUSE SLES15 Security Update : pam_radius (SUSE-SU-2021:1896-1)	Nessus	SuSE Local Security Checks	high
139247	Debian DLA-2304-1 : libpam-radius-auth security update	Nessus	Debian Local Security Checks	high
136024	SUSE SLES12 Security Update : pam_radius (SUSE-SU-2020:1117-1)	Nessus	SuSE Local Security Checks	high
134037	Ubuntu 16.04 LTS / 18.04 LTS : libpam-radius-auth vulnerability (USN-4290-1)	Nessus	Ubuntu Local Security Checks	high
133877	Debian DLA-2116-1 : libpam-radius-auth security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2015-9542

high

Tenable Plugins

high

high

high

high

high

high

high