Technical Description

Multiple vulnerabilities have been identified in Raydium, which could be exploited by remote attackers to execute arbitrary commands or cause a denial of service.

The first issue is due to buffer overflow errors in the "raydium_log()" [log.c] and "raydium_console_line_add()" [console.c] functions that do not properly validate user-supplied input, which could be exploited by malicious clients to compromise a vulnerable system.

The second flaw is due to a format string error in the "raydium_log()" function when logging user-supplied input, which could be exploited by malicious clients to compromise a vulnerable system.

The third vulnerability is due to a NULL pointer dereference error in the "raydium_network_netcall_exec()" [network.c] function when handling malformed packets, which could be exploited by attackers to crash a vulnerable application.

The fourth issue is due to buffer overflow and invalid memory access errors in the "raydium_network_read()" [network.c] function, which could be exploited by attackers to execute arbitrary commands or cause a denial of service via a specially crafted packet.

Affected Products

Raydium version 2005-09-21 and prior
Raydium SVN revision 309 and prior

Solution

Issue #1 and #2 have been fixed in SVN revision 310 :
http://raydium.org/svn.php

References

http://www.vupen.com/english/advisories/2006/1808
http://www.frsirt.com/english/reference/11710

Credits

Vulnerabilities reported by Luigi Auriemma

ChangeLog

2006-05-15 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.