Unscored severity · published Dec 23, 2004
CVE-2004-0849
Integer overflow in the asn_decode_string() function defined in asn1.c in radiusd for GNU Radius 1.1 and 1.2 before 1.2.94, when compiled with the --enable-snmp option, allows…
–
CVSS
1.6%
EPSS
No
On KEV
Description
Integer overflow in the asn_decode_string() function defined in asn1.c in radiusd for GNU Radius 1.1 and 1.2 before 1.2.94, when compiled with the --enable-snmp option, allows remote attackers to cause a denial of service (daemon crash) via certain SNMP requests.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
Radius · Gnu
0.92.1; 0.93; 0.94; 0.95; 0.96; 1.1; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-0849
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-0849
Patch
http://lists.gnu.org/archive/html/info-gnu-radius/2004-09/msg00000.html
Patch
http://www.idefense.com/application/poi/display?id=141&type=vulnerabilities
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/17391
More from Radius
–
CVE-2006-4181
Format string vulnerability in the sqllog function in the SQL accounting code for radiusd in GNU Radius 1.2 and 1.3 allows remote attackers to execute arbitrary code via unknown…
–
CVE-2004-0576
The radius daemon (radiusd) for GNU Radius 1.1, when compiled with the -enable-snmp option, allows remote attackers to cause a denial of service (server crash) via malformed SNMP…
–
CVE-2004-0131
The rad_print_request function in logger.c for GNU Radius daemon (radiusd) before 1.2 allows remote attackers to cause a denial of service (crash) via a UDP packet with an…
–
CVE-2001-1376
Buffer overflow in digest calculation function of multiple RADIUS implementations allows remote attackers to cause a denial of service and possibly execute arbitrary code via…
–
CVE-2001-1377
Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers to cause a denial of service (crash) via…