CVE-2015-9542

add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer…

published February 24, 2020

CVSS
—
EPSS
3%
Percentile
88.9
In the wild
Unconfirmed
What it is

add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a crafted password to an application (loading the pam_radius library) and crash it. Arbitrary code execution might be possible, depending on the application, C library, compiler, and other factors.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03466 · 88.9th percentile
Published
2020-02-24T14:14Z
EPSS history
Timeline
  • 24 FEB 14:14Z
    add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer…
    cvelistv5