CISCO vulnerability allows remote attacker to take control of Windows system

Cisco has fixed a critical vulnerability in Secure Access Control Server for Windows that could allow remote attackers to execute arbitrary commands and take control of the underlying operating system. Cisco Secure ACS is an application that allows companies to centrally manage access to network...

CVE-2013-3466

The EAP-FAST authentication module in Cisco Secure Access Control Server ACS 4.x before 4.2.1.15.11, when a RADIUS server configuration is enabled, does not properly parse user identities, which allows remote attackers to execute arbitrary commands via crafted EAP-FAST packets, aka Bug ID...

CVE-2013-3466

Cisco Secure ACS (Windows) 4.x (including 4.0–4.2.1.15) is affected when configured as a RADIUS server. The EAP-FAST authentication module fails to properly parse user identities, allowing remote attackers to send crafted EAP-FAST packets to execute arbitrary commands on the ACS host. The vulnera...

CVE-2013-3466

The EAP-FAST authentication module in Cisco Secure Access Control Server ACS 4.x before 4.2.1.15.11, when a RADIUS server configuration is enabled, does not properly parse user identities, which allows remote attackers to execute arbitrary commands via crafted EAP-FAST packets, aka Bug ID...

Cisco Releases Security Advisory

Cisco has released a security advisory to address a vulnerability in Cisco Secure Access Control Server ACS versions 4.0 through 4.2.1.15. This vulnerability could allow an unauthenticated, remote attacker to execute arbitrary commands. The vulnerability is only present when Cisco ACS is configur...

Remote Unauthenticated Bug Haunts Cisco ACS Server

There is a critical remotely exploitable vulnerability in Cisco’s Secure Access Control Server which allows a remote attacker to take complete control of a vulnerable server. The bug results from a bad implementation of the EAP-FAST protocol and it affects a number of versions of the Cisco ACS. T...

Cisco Secure Access Control Server Remote Command Execution Vulnerability

A vulnerability in the EAP-FAST authentication module of Cisco Secure Access Control Server ACS versions 4.0 through 4.2.1.15 could allow an unauthenticated, remote attacker to execute arbitrary commands on the Cisco Secure ACS server. This vulnerability is only present when Cisco Secure ACS is...

Fedora Update for php-pecl-radius FEDORA-2013-11911

Check for the Version of php-pecl-radius OpenVAS Vulnerability Test Fedora Update for php-pecl-radius FEDORA-2013-11911 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modif...

Fedora Update for php-pecl-radius FEDORA-2013-11911

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2013-4147

Multiple format string vulnerabilities in Yet Another Radius Daemon YARD RADIUS 1.1.2 allow context-dependent attackers to cause a denial of service crash or possibly execute arbitrary code via format string specifiers in a request in the 1 logmsg function in log.c or 2 version or 3 buildversion...

Format string

Multiple format string vulnerabilities in Yet Another Radius Daemon YARD RADIUS 1.1.2 allow context-dependent attackers to cause a denial of service crash or possibly execute arbitrary code via format string specifiers in a request in the 1 logmsg function in log.c or 2 version or 3 buildversion...

CVE-2013-4147

Multiple format string vulnerabilities in Yet Another Radius Daemon YARD RADIUS 1.1.2 allow context-dependent attackers to cause a denial of service crash or possibly execute arbitrary code via format string specifiers in a request in the 1 logmsg function in log.c or 2 version or 3 buildversion...

CVE-2013-4147

CVE-2013-4147 affects Yet Another Radius Daemon (YARD RADIUS) 1.1.2, with multiple format-string vulnerabilities in log_msg (log.c) and version/build_version (version.c) that can cause a crash or potentially allow arbitrary code execution. An exploit exists per CIRCL/Xploit-DB linkage, indicating...

CVE-2013-4147

Multiple format string vulnerabilities in Yet Another Radius Daemon YARD RADIUS 1.1.2 allow context-dependent attackers to cause a denial of service crash or possibly execute arbitrary code via format string specifiers in a request in the 1 logmsg function in log.c or 2 version or 3 buildversion...

CVE-2013-4673

The management console on the Symantec Web Gateway SWG appliance before 5.1.1 does not properly implement RADIUS authentication, which allows remote attackers to execute arbitrary code by leveraging access to the login prompt...

CVE-2013-4673

The CVE-2013-4673 issue affects Symantec Web Gateway (SWG) prior to version 5.1.1 where the management console’s RADIUS authentication is not properly implemented, allowing remote attackers with access to the login prompt to execute arbitrary code. Connected advisories confirm the root cause as a...

CVE-2013-4673

The management console on the Symantec Web Gateway SWG appliance before 5.1.1 does not properly implement RADIUS authentication, which allows remote attackers to execute arbitrary code by leveraging access to the login prompt...

CVE-2013-2220

Buffer overflow in the radiusgetvendorattr function in the Radius extension before 1.2.7 for PHP allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a large Vendor Specific Attributes VSA length value...

DEBIAN-CVE-2013-2220

Buffer overflow in the radiusgetvendorattr function in the Radius extension before 1.2.7 for PHP allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a large Vendor Specific Attributes VSA length value...

Buffer overflow

Buffer overflow in the radiusgetvendorattr function in the Radius extension before 1.2.7 for PHP allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a large Vendor Specific Attributes VSA length value...