Vulnerable Systems:
* GNU Radius versions 1.3 and 1.2.
Remote exploitation of a format string vulnerability in GNU Radius could allow an attacker to execute code in the context of the running daemon.
The vulnerability specifically exists within the SQL accounting code. A format string is built using user supplied data and then unsafely passed to the variable argument function 'sqllog'.
Successful exploitation allows unauthenticated remote attackers to execute arbitrary code in the context of the running radius daemon (radiusd). Typically the radius daemon will run as root.
Exploitation requires that radiusd be compiled with an SQL back-end and SQL accounting be turned on. These options are both turned on by default for FreeBSD and Gentoo Linux.
Workaround:
Using one of the other supported accounting methods will mitigate exploitation of this vulnerability while still allowing accounting to take place.
Vendor Status:
The GNU Radius team included a fix for this vulnerability in version 1.4.
