FreeRADIUS: buffer overflow and SQL injection
| Package(s): | freeradius | CVE #(s): | CAN-2005-1454 CAN-2005-1455 | ||||||||||||
| Created: | May 17, 2005 | Updated: | June 23, 2005 | ||||||||||||
| Description: | Primoz Bratanic discovered that the sql_escape_func function of FreeRADIUS 1.0.2 and earlier may be vulnerable to a buffer overflow. He also discovered that FreeRADIUS fails to sanitize user-input before using it in a SQL query, possibly allowing SQL command injection. | ||||||||||||||
| Alerts: |
| ||||||||||||||