Red Hat Bugzilla – Bug 521912
CVE-2009-3111 FreeRADIUS: Missing check for Tunnel-Password attributes with zero length (DoS) -- re-appearance of CVE-2003-0967
Last modified: 2010-03-29 06:02:09 EDT
A missing check for proper form of certain attributes was originally found in the way FreeRADIUS used to decode specific RADIUS attributes into data structures. A remote attacker could send a specially-crafted RADIUS packet to the RADIUS server, leading to a denial of service (radiusd daemon crash), CVE-2003-0967. This flaw was fixed in upstream 0.9.3 version of FreeRADIUS and re-introduced later. References: ----------- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0967 https://www.kb.cert.org/vuls/id/541574 http://rhn.redhat.com/errata/RHSA-2003-386.html Upstream patch: --------------- http://github.com/alandekok/freeradius-server/commit/860cad9e02ba344edb0038419e415fe05a9a01f4
This issue does NOT affect the versions of freeradius package, as shipped in Red Hat Enterprise Linux 3 and 4. This issue affects the version of freeradius package, as shipped in Red Hat Enterprise Linux 5.
Public via: https://lists.freeradius.org/pipermail/freeradius-users/2009-September/msg00242.html
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-3111 to the following vulnerability: The rad_decode function in FreeRADIUS before 1.1.8 allows remote attackers to cause a denial of service (radiusd crash) via zero-length Tunnel-Password attributes. NOTE: this is a regression error related to CVE-2003-0967. References: ----------- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3111 https://lists.freeradius.org/pipermail/freeradius-users/2009-September/msg00242.html http://www.openwall.com/lists/oss-security/2009/09/09/1 http://github.com/alandekok/freeradius-server/commit/860cad9e02ba344edb0038419e415fe05a9a01f4
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2009:1451 https://rhn.redhat.com/errata/RHSA-2009-1451.html