CVE-2005-4744
6.4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
7.5 High
AI Score
Confidence
Low
0.022 Low
EPSS
Percentile
89.6%
Off-by-one error in the sql_error function in sql_unixodbc.c in FreeRADIUS 1.0.2.5-5, and possibly other versions including 1.0.4, might allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by causing the external database query to fail. NOTE: this single issue is part of a larger-scale disclosure, originally by SUSE, which reported multiple issues that were disputed by FreeRADIUS. Disputed issues included file descriptor leaks, memory disclosure, LDAP injection, and other issues. Without additional information, the most recent FreeRADIUS report is being regarded as the authoritative source for this CVE identifier.
Affected configurations
References
ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc
rhn.redhat.com/errata/RHSA-2006-0271.html
secunia.com/advisories/16712
secunia.com/advisories/19497
secunia.com/advisories/19518
secunia.com/advisories/19811
secunia.com/advisories/20461
www.debian.org/security/2006/dsa-1089
www.freeradius.org/security/20050909-response-to-suse.txt
www.freeradius.org/security/20050909-vendor-sec.txt
www.securityfocus.com/bid/14775
wwwnew.mandriva.com/security/advisories?name=MDKSA-2006:066
bugzilla.redhat.com/bugzilla/show_bug.cgi?id=167676
exchange.xforce.ibmcloud.com/vulnerabilities/22211
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10449
Related
6.4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
7.5 High
AI Score
Confidence
Low
0.022 Low
EPSS
Percentile
89.6%