OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Buffer Overflow in version .14
From: Jesse Schachter (jschachterPSNW.COM)
Date: Mon Apr 24 2000 - 02:43:57 CDT

IC Radius version .14, and possibly earlier versions, contain a buffer
overflow that occurs when trying to authenticate with a valid username
longer than 24 characters.

The culprit is in mysql.c, in the function sql_getvpdata. This function is
normally run 4 times during authentication. The second time it is run, in
the PW_VP_GROUPDATA section, several sprintf's are used to build the group
query. The string which it all ends up in, querystr, is statically
allocated 256 bytes. Under normal circumstances, this is ok, but the
variable is right at its limits using the default setup. It might be
different depending on how you have your table names and group names
setup. However, it doesn't take much to overflow it.

On my system, once it started to overflow, it began to overwrite the
username pointer. Results may vary. To fix it, I just increased the size
allocated to querystr to 512 bytes. However, in future versions of the
code, it'd be cool to have some bounds checking, and more use of snprintf
so the server doesn't segfault.

_.,+=~`^"-.,_.,+=~`^"-*.,_.,+=~'`^"-.,_.,+=~`^"-.,_.,+=~`^"-.,_.,+=~`^"-.,
  Jesse Schachter .,. Systems Administrator
  The Protosource Network .,. Main Number: (888) 643-8558
  <JSchachterPSNW.COM> .,. Fax: (559) 490-8630
_.,+=~`^"-.,_.,+=~`^"-.,_.,+=~`^"-.,_.,+*=~`^"-.,_.,+=%~`^"-.,_.,+=~`^"-.,