CVE-2013-4147: yard_radius_project yard_radius

Vulnerability summary

CVE-2013-4147 is a high (CVSS 7.5) vulnerability in yard_radius_project yard_radius. EPSS estimates a 3.66% chance of exploitation in the next 30 days, higher than 89.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 09-08-2013
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

Multiple format string vulnerabilities in Yet Another Radius Daemon (YARD RADIUS) 1.1.2 allow context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via format string specifiers in a request in the (1) log_msg function in log.c or (2) version or (3) build_version function in version.c.

• CWE-134Use of Externally-Controlled Format StringThe product uses a function that accepts a format string as an argument, but the format string originates from an external source.