Chloe Ong

The issue is related to a memory corruption vulnerability in the telnet input char function. This vulnerability occurs because user input cmdline len is copied into a fixed buffer b->buf without any bound checks. As a result, if the server connects with a malicious client, crafted client requests can remotely trigger this vulnerability.

The issue arises from a buffer overflow vulnerability in the `rad packet recv` function, located in `opt/src/accel-pppd/radius/packet.c`. This vulnerability occurs because user input `len` is copied into a fixed buffer `&attr->val.integer` without any bound checks. When a client connects to the server and sends a large radius packet, this buffer overflow vulnerability can be triggered.

The issue is related to a memcpy buffer overflow in the `rad packet recv` function, located in `radius/packet.c`. This overflow occurs due to an overly-large `recvfrom` into a fixed buffer, causing a buffer overflow that overwrites arbitrary memory. The vulnerability can be remotely triggered by crafted client requests if the server connects with a malicious client.