Bug 236248

Summary:	CVE-2007-2028 Freeradius EAP-TTLS denial of service
Product:	[Fedora] Fedora	Reporter:	Josh Bressers <bressers>
Component:	freeradius	Assignee:	Thomas Woerner <twoerner>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	6	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	impact=moderate,source=freeradius,public=20070412,reported=20070412
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-05-30 19:54:50 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Josh Bressers 2007-04-12 17:41:00 UTC

+++ This bug was initially created as a clone of Bug #236247 +++

A flaw was found in the way FreeRADIUS parses certain authentication requests.
The upstream description explain it as such:
http://www.freeradius.org/security.html

    2007.04.10 v1.1.5, and earlier - A malicous 802.1x supplicant could send
    malformed Diameter format attributes inside of an EAP-TTLS tunnel. The
    server would reject the authentication request, but would leak one
    VALUE_PAIR data structure, of approximately 300 bytes. If an attacker
    performed the attack many times (e.g. thousands or more over a period of
    minutes to hours), the server could leak megabytes of memory, potentially
    leading to an "out of memory" condition, and early process exit.

    We recommend that administrators using EAP-TTLS upgrade immediately.
    This bug was found as part of the Coverity Scan project.

The EAP-TTLS support is not enabled by default in any FreeRADIUS
installations.


This flaw also affects FC5

-- Additional comment from bressers on 2007-04-12 13:31 EST --
Created an attachment (id=152488)
Upstream Patch

Comment 1 Fedora Update System 2007-05-14 17:06:03 UTC

freeradius-1.1.3-2.fc6 has been pushed for fc6, which should resolve this issue.  If these problems are still present in this version, then please make note of it in this bug report.