CVE-2015-9542

What it actually does

Stack-based buffer overflow in pam_radius add_password function allows memcpy of an unchecked input password, enabling application crash or potential arbitrary code execution depending on runtime environment.

Why it matters to the business

Authentication services using the affected PAM module can be disrupted or compromised, leading to denial of service against login flows or possible unauthorized access on systems that rely on this library for RADIUS authentication.

How an attack unfolds

An attacker supplies an oversized crafted password to any application that loads the vulnerable pam_radius library; the missing length check permits overflow during memcpy, which may crash the process or allow control-flow hijacking under favorable memory layout conditions.

How to fix it

Upgrade pam_radius to a version containing the length check fix; where an update is unavailable, replace the module with an unaffected RADIUS PAM implementation or enforce strict input validation at the application layer before PAM invocation.

How to confirm the fix worked

Confirm the installed pam_radius_auth.c contains an explicit password length check before the memcpy call; recompile and test authentication with both normal and maximum-length passwords to verify stability.

Typical attack path

1. Identify services or applications that invoke pam_radius for authentication
2. Send an authentication request containing an excessively long password string
3. Trigger the vulnerable add_password path and overflow the stack buffer
4. Observe crash or attempt to redirect execution to attacker-controlled data

How to detect it

Review authentication logs and system crash reports for segmentation faults or aborts occurring inside pam_radius or processes that load it; correlate with unusual authentication attempts containing long password fields.

• segmentation fault in pam_radius_auth
• memcpy overflow pam_radius
• pam authentication crash radius

What your security team should do

• Inventory all systems using pam_radius and prioritize patching or replacement
• Monitor authentication service availability and process crash logs for signs of exploitation attempts
• Apply network-level rate limiting on authentication endpoints until remediation is complete