Bug 521912 (CVE-2009-3111) - CVE-2009-3111 FreeRADIUS: Missing check for Tunnel-Password attributes with zero length (DoS) -- re-appearance of CVE-2003-0967
Summary: CVE-2009-3111 FreeRADIUS: Missing check for Tunnel-Password attributes with z...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2009-3111
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://github.com/alandekok/freeradiu...
Whiteboard:
Depends On: 522062 522063
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-09-08 16:52 UTC by Jan Lieskovsky
Modified: 2019-09-29 12:32 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-03-29 10:02:09 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2009:1451 0 normal SHIPPED_LIVE Moderate: freeradius security update 2009-09-17 14:45:56 UTC

Description Jan Lieskovsky 2009-09-08 16:52:44 UTC
A missing check for proper form of certain attributes was originally 
found in the way FreeRADIUS used to decode specific RADIUS attributes
into data structures. A remote attacker could send a specially-crafted
RADIUS packet to the RADIUS server, leading to a denial of service
(radiusd daemon crash), CVE-2003-0967. This flaw was fixed in upstream
0.9.3 version of FreeRADIUS and re-introduced later.

References:
-----------
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0967
https://www.kb.cert.org/vuls/id/541574
http://rhn.redhat.com/errata/RHSA-2003-386.html

Upstream patch:
---------------
http://github.com/alandekok/freeradius-server/commit/860cad9e02ba344edb0038419e415fe05a9a01f4

Comment 4 Jan Lieskovsky 2009-09-09 11:07:52 UTC
This issue does NOT affect the versions of freeradius package, as shipped
in Red Hat Enterprise Linux 3 and 4.

This issue affects the version of freeradius package, as shipped
in Red Hat Enterprise Linux 5.

Comment 11 Jan Lieskovsky 2009-09-09 18:04:41 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-3111 to
the following vulnerability:

The rad_decode function in FreeRADIUS before 1.1.8 allows remote
attackers to cause a denial of service (radiusd crash) via zero-length
Tunnel-Password attributes.  NOTE: this is a regression error related
to CVE-2003-0967.

References:
-----------
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3111
https://lists.freeradius.org/pipermail/freeradius-users/2009-September/msg00242.html
http://www.openwall.com/lists/oss-security/2009/09/09/1
http://github.com/alandekok/freeradius-server/commit/860cad9e02ba344edb0038419e415fe05a9a01f4

Comment 12 errata-xmlrpc 2009-09-17 14:46:07 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:1451 https://rhn.redhat.com/errata/RHSA-2009-1451.html


Note You need to log in before you can comment on or make changes to this bug.