Bug 521912 (CVE-2009-3111)

Summary:	CVE-2009-3111 FreeRADIUS: Missing check for Tunnel-Password attributes with zero length (DoS) -- re-appearance of CVE-2003-0967
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jdennis, kreilly, mvadkert, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://github.com/alandekok/freeradius-server/commit/860cad9e02ba344edb0038419e415fe05a9a01f4
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-03-29 10:02:09 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	522062, 522063
Bug Blocks:

Description Jan Lieskovsky 2009-09-08 16:52:44 UTC

A missing check for proper form of certain attributes was originally 
found in the way FreeRADIUS used to decode specific RADIUS attributes
into data structures. A remote attacker could send a specially-crafted
RADIUS packet to the RADIUS server, leading to a denial of service
(radiusd daemon crash), CVE-2003-0967. This flaw was fixed in upstream
0.9.3 version of FreeRADIUS and re-introduced later.

References:
-----------
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0967
https://www.kb.cert.org/vuls/id/541574
http://rhn.redhat.com/errata/RHSA-2003-386.html

Upstream patch:
---------------
http://github.com/alandekok/freeradius-server/commit/860cad9e02ba344edb0038419e415fe05a9a01f4

Comment 4 Jan Lieskovsky 2009-09-09 11:07:52 UTC

This issue does NOT affect the versions of freeradius package, as shipped
in Red Hat Enterprise Linux 3 and 4.

This issue affects the version of freeradius package, as shipped
in Red Hat Enterprise Linux 5.

Comment 8 Jan Lieskovsky 2009-09-09 13:38:34 UTC

Public via:

https://lists.freeradius.org/pipermail/freeradius-users/2009-September/msg00242.html

Comment 11 Jan Lieskovsky 2009-09-09 18:04:41 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2009-3111 to
the following vulnerability:

The rad_decode function in FreeRADIUS before 1.1.8 allows remote
attackers to cause a denial of service (radiusd crash) via zero-length
Tunnel-Password attributes.  NOTE: this is a regression error related
to CVE-2003-0967.

References:
-----------
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3111
https://lists.freeradius.org/pipermail/freeradius-users/2009-September/msg00242.html
http://www.openwall.com/lists/oss-security/2009/09/09/1
http://github.com/alandekok/freeradius-server/commit/860cad9e02ba344edb0038419e415fe05a9a01f4

Comment 12 errata-xmlrpc 2009-09-17 14:46:07 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:1451 https://rhn.redhat.com/errata/RHSA-2009-1451.html