FreeRADIUS 'Ascend-Send-Secret' Processing Error Lets Remote Users Crash the Service
|
|
SecurityTracker Alert ID: 1011364
|
|
SecurityTracker URL: http://securitytracker.com/id?1011364
|
|
CVE Reference: CAN-2004-0938
, CAN-2004-0960
, CAN-2004-0961
(Links to External Site)
|
|
OSVDB Reference: 10178
(Links to External Site)
|
Updated: Oct 20 2004
|
Original Entry Date: Sep 20 2004
|
Impact: Denial of service via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 1.0.0
|
Description: A vulnerability was reported in FreeRADIUS. A remote user can cause the target RADIUS service to crash.
The VulnDisco RADIUS test suite includes tests for a previously unreported denial of service vulnerability in FreeRADIUS 1.0.0.
The
vendor reported that Ascend-Send-Secret, like Tunnel-Password, requires an "original" packet to decode the attribute [CVE: ]. The
software checks for Tunnel-Password, but not Ascend-Send-Secret.
The flaw resides in 'radius.c' and 'eap_tls.c'.
The vendor
also reported that a remote user can supply malformed USR vendor-specific attributes to invoke a memcpy() operation with a '-1'
argument, causing the RADIUS service to crash [CVE: CAN-2004-0960].
The vendor also reported that a remote user can send a series
of Access-Request packets with Ascend-Send-Secret, Ascend-Recv-Secret, or Tunnel-Password attributes to cause the service to consume
all available memory [CVE: CAN-2004-0961].
|
Impact: A remote user can cause the RADIUS service to crash.
|
Solution: The vendor has released a fixed version (1.0.1), available at:
ftp://ftp.freeradius.org/pub/radius/
|
Vendor URL: www.freeradius.org/ (Links to External Site)
|
Cause: Exception handling error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Mon, 20 Sep 2004 09:48:06 -0400
Subject: http://www.gleg.net/security_radius_testsuite.shtml
|
The VulnDisco RADIUS test suite includes tests for a previously unreported denial
of service vulnerability in FreeRADIUS 1.0.0.
The vendor reported that Ascend-Send-Secret, like Tunnel-Password, requires an
"original" packet to decode the attribute. The software checks for Tunnel-Password,
but not Ascend-Send-Secret.
The flaw resides in 'radius.c' and 'eap_tls.c'.
The vendor has released a fixed version (1.0.1), available at:
ftp://ftp.freeradius.org/pub/radius/
|
|
