AOH :: HP Unsorted F :: C07-1557.HTM

FreeRadius 1.1.3 SMB_Handle_Type SMB_Connect_Server arbitrary code execution



FreeRadius 1.1.3 SMB_Handle_Type SMB_Connect_Server arbitrary code execution
FreeRadius 1.1.3 SMB_Handle_Type SMB_Connect_Server arbitrary code execution



Synopsis:  
FreeRadius 1.1.3  SMB_Handle_Type SMB_Connect_Server arbitrary code execution

Product:   FreeRadius
Version:   <=1.1.3



Issue:
=====
A critical security vulnerability has been found in FreeRadius 1.1.3.
Arbitrary code execution is possible due to improper bounds-checking. 


Details:
=======Function of the prototype:

SMB_Handle_Type SMB_Connect_Server(SMB_Handle_Type Con_Handle,
				   char *server, char *NTdomain)

when initializing (con->desthost) where con is SMB_Handle_Type class
object does not check for bounds. 




Affected Versions
================
FreeRadius <=1.1.3



Kind regards,

Michal Bucko (sapheal)
hack.pl




The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.