CVE-2014-2015 Memory corruption in n/a

High 7.5 Published 2 Nov 2014 Updated 6 Aug 2024

Attackers can trigger a stack-based buffer overflow in FreeRADIUS via long password hashes, potentially causing crashes or executing arbitrary code.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2014-2015?

CVE-2014-2015 is a high-severity memory corruption vulnerability in n/a, published on 2 Nov 2014. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Stack-based buffer overflow in the normify function in the rlm_pap module (modules/rlm_pap/rlm_pap.c) in FreeRADIUS 2.x, possibly 2.2.3 and earlier, and 3.x, possibly 3.0.1 and earlier, might allow attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long password hash, as demonstrated by an SSHA hash.

Weakness: CWE-119

Which versions are affected by CVE-2014-2015?

It affects 1 product.

Linux distribution packages (20)

`freeradius` Red Hat:enterprise_linux:6::server	All versions	`0:2.2.6-4.el6`
`freeradius-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`0:2.2.6-4.el6`
`freeradius-krb5` Red Hat:enterprise_linux:6::server	All versions	`0:2.2.6-4.el6`
`freeradius-ldap` Red Hat:enterprise_linux:6::server	All versions	`0:2.2.6-4.el6`
`freeradius-mysql` Red Hat:enterprise_linux:6::server	All versions	`0:2.2.6-4.el6`
`freeradius-perl` Red Hat:enterprise_linux:6::server	All versions	`0:2.2.6-4.el6`
`freeradius-postgresql` Red Hat:enterprise_linux:6::server	All versions	`0:2.2.6-4.el6`
`freeradius-python` Red Hat:enterprise_linux:6::server	All versions	`0:2.2.6-4.el6`
`freeradius-unixODBC` Red Hat:enterprise_linux:6::server	All versions	`0:2.2.6-4.el6`
`freeradius-utils` Red Hat:enterprise_linux:6::server	All versions	`0:2.2.6-4.el6`
`freeradius` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.2.6-4.el6`
`freeradius-debuginfo` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.2.6-4.el6`
`freeradius-krb5` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.2.6-4.el6`
`freeradius-ldap` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.2.6-4.el6`
`freeradius-mysql` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.2.6-4.el6`
`freeradius-perl` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.2.6-4.el6`
`freeradius-postgresql` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.2.6-4.el6`
`freeradius-python` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.2.6-4.el6`
`freeradius-unixODBC` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.2.6-4.el6`
`freeradius-utils` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.2.6-4.el6`

Products include Freeradius Freeradius.

How do I fix CVE-2014-2015?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2014-2015 being exploited?

There is no known exploitation of CVE-2014-2015 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2014-2015, GHSA-4w6w-6xrm-w35q, MGASA-2014-0088, RHSA-2015:1287.