Login Request a demo
Unscored severity · published Nov 28, 2006
CVE-2006-4181
Format string vulnerability in the sqllog function in the SQL accounting code for radiusd in GNU Radius 1.2 and 1.3 allows remote attackers to execute arbitrary code via unknown…
–
CVSS
5%
EPSS
No
On KEV
Description
Format string vulnerability in the sqllog function in the SQL accounting code for radiusd in GNU Radius 1.2 and 1.3 allows remote attackers to execute arbitrary code via unknown vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.0% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
Radius · Gnu
1.2; 1.3 · source: NVD
Affected product
RA
Radius
Gnu
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-4181
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-4181
Patch
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=443
Patch
http://secunia.com/advisories/23087
security.gentoo.org
http://security.gentoo.org/glsa/glsa-200612-17.xml
Patch
http://securitytracker.com/id?1017285
Patch
http://www.securityfocus.com/bid/21303
www.vupen.com
http://www.vupen.com/english/advisories/2006/4712
More from Radius
–
CVE-2004-0849
Integer overflow in the asn_decode_string() function defined in asn1.c in radiusd for GNU Radius 1.1 and 1.2 before 1.2.94, when compiled with the --enable-snmp option, allows…
–
CVE-2004-0576
The radius daemon (radiusd) for GNU Radius 1.1, when compiled with the -enable-snmp option, allows remote attackers to cause a denial of service (server crash) via malformed SNMP…
–
CVE-2004-0131
The rad_print_request function in logger.c for GNU Radius daemon (radiusd) before 1.2 allows remote attackers to cause a denial of service (crash) via a UDP packet with an…
–
CVE-2001-1376
Buffer overflow in digest calculation function of multiple RADIUS implementations allows remote attackers to cause a denial of service and possibly execute arbitrary code via…
–
CVE-2001-1377
Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers to cause a denial of service (crash) via…