Multiple Format String Vulnerabilities in yardradius

[Hamid Zamani]

Hello

Several Format String vulnerabilities was found in the latest `yardradius` version as
explained further below :

src/log.c :

void
log_msg(int priority,char *fmt, va_list args)
{
...
 char buffer[1024];
...
 vfprintf(msgfd, fmt, args); // !
...
        vsnprintf(buffer,1024,fmt, args); // !
#if defined(HAVE_SYSLOG)
        syslog(priority, buffer); // !
...
        vsyslog(priority, fmt, args); // !
...
}

So an attacker can fill fmt by for ex. "%x" and see the addressess.

############

src/version.c :

#define STRVER "%s : YARD Radius Server %s ... $ "

void
version(void)
{
        char buffer[1024];

        build_version(buffer,sizeof(buffer));
        fprintf(stderr, buffer);
        exit(-1);
}

...

void
build_version(char *bp,size_t sizeofbp)
{
        snprintf(bp,sizeofbp-1,STRVER, progname, VERSION);
..

$ ln -s radiusd %x
$ ./%x -v
./b77c0ff4 : YARD Radius Server 1.1 ...

It seems more of this type vulnerability exists in the source
if i find any other bug i will file them ...

Thank you
Hamid Zamani

[Seth Arnold (seth-arnold)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures