CVE-2005-4745

SQL injection vulnerability in the rlmsqlcounter module in FreeRADIUS 1.0.3 and 1.0.4 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors...

Debian Security Advisory DSA 1145-1 (freeradius)

The remote host is missing an update to freeradius announced via advisory DSA 1145-1. Several remote vulnerabilities have been discovered in freeradius, a high-performance RADIUS server, which may lead to SQL injection or denial of service. The Common Vulnerabilities and Exposures project...

CVE-2005-4745

CVE-2005-4745 is a SQL injection vulnerability in the rlm_sqlcounter module of FreeRADIUS 1.0.3 and 1.0.4. The issue permits remote attackers to execute arbitrary SQL commands via unknown attack vectors. Documentation in multiple advisories (e.g., Debian DSA-1145-1) corroborates the SQL injection...

CVE-2005-4746

Multiple buffer overflows in FreeRADIUS 1.0.3 and 1.0.4 allow remote attackers to cause denial of service crash via 1 the rlmsqlcounter module or 2 unknown vectors "while expanding %t"...

CVE-2005-4746

Multiple buffer overflows in FreeRADIUS 1.0.3 and 1.0.4 allow remote attackers to cause denial of service crash via 1 the rlmsqlcounter module or 2 unknown vectors "while expanding %t"...

CVE-2005-4745

SQL injection vulnerability in the rlmsqlcounter module in FreeRADIUS 1.0.3 and 1.0.4 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors...

CVE-2005-4746

Multiple buffer overflows in FreeRADIUS 1.0.3 and 1.0.4 allow remote attackers to cause denial of service crash via 1 the rlmsqlcounter module or 2 unknown vectors "while expanding %t"...

CVE-2005-4745

SQL injection vulnerability in the rlmsqlcounter module in FreeRADIUS 1.0.3 and 1.0.4 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors...

freeradius -- multiple vulnerabilities

The freeradious development team reports: Multiple issues exist with version 1.0.4, and all prior versions of the server. Externally exploitable vulnerabilities exist only for sites that use the rlmsqlcounter module. Those sites may be vulnerable to SQL injection attacks, similar to the issues...