CVE-2005-4744 | Vulnetix

CVE-2005-4744 PUBLISHED CVSS 6.400000095367432 MEDIUM

Off-by-one error in the sql_error function in sql_unixodbc.c in FreeRADIUS 1.0.2.5-5, and possibly other versions including 1.0.4, might allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by causing the external database query to fail. NOTE: this single issue is part of a larger-scale disclosure, originally by SUSE, which reported multiple issues that were disputed by FreeRADIUS. Disputed issues included file descriptor leaks, memory disclosure, LDAP injection, and other issues. Without additional information, the most recent FreeRADIUS report is being regarded as the authoritative source for this CVE identifier.

EPSS 4.38% · 90.4th percentile

Risk Scores

CVSS 2.0

6.400000095367432

EPSS Score

4.38%

90.4th percentile

Affected Products

Vendor	Product	Versions
freeradius	freeradius	1.0.3, 1.0.4
n/a	n/a	n/a

Timeline

Dec 31, 2005 CVE Published
Feb 4, 2022 EPSS Score
Mar 29, 2022 EPSS Score
May 20, 2022 EPSS Score
Jul 12, 2022 EPSS Score
Oct 27, 2022 EPSS Score
Dec 18, 2022 EPSS Score
Feb 9, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Apr 3, 2023 EPSS Score
May 26, 2023 EPSS Score
Jul 17, 2023 EPSS Score

References

19811 third-party-advisory
MDKSA-2006:066 vendor-advisory
DSA-1089 vendor-advisory
16712 third-party-advisory
20060404-01-U vendor-advisory
14775 vdb
20461 third-party-advisory
19497 third-party-advisory
https://nvd.nist.gov/vuln/detail/CVE-2005-4744 advisory
http://rhn.redhat.com/errata/RHSA-2006-0271.html url
http://www.freeradius.org/security/20050909-response-to-suse.txt url
http://secunia.com/advisories/19518 technical
https://exchange.xforce.ibmcloud.com/vulnerabilities/22211 technical
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10449 technical
http://www.freeradius.org/security/20050909-vendor-sec.txt technical
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=167676 technical

Open in Interactive Console →