CVE-2009-3111

The rad_decode function in FreeRADIUS before 1.1.8 allows remote attackers to cause a denial of service (radiusd crash) via zero-length Tunnel-Password attributes, as demonstrated by a certain module in VulnDisco Pack Professional 7.6 through 8.11. NOTE: this is a regression error related to CVE-2003-0967.
References
Link Resource
http://github.com/alandekok/freeradius-server/commit/860cad9e02ba344edb0038419e415fe05a9a01f4 Patch
http://intevydis.com/vd-list.shtml
http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html
http://secunia.com/advisories/36509
http://support.apple.com/kb/HT3937
http://www.openwall.com/lists/oss-security/2009/09/09/1 Patch
http://www.redhat.com/support/errata/RHSA-2009-1451.html
http://www.securityfocus.com/bid/36263
http://www.vupen.com/english/advisories/2009/3184
https://lists.freeradius.org/pipermail/freeradius-users/2009-September/msg00242.html
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9919
http://github.com/alandekok/freeradius-server/commit/860cad9e02ba344edb0038419e415fe05a9a01f4 Patch
http://intevydis.com/vd-list.shtml
http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html
http://secunia.com/advisories/36509
http://support.apple.com/kb/HT3937
http://www.openwall.com/lists/oss-security/2009/09/09/1 Patch
http://www.redhat.com/support/errata/RHSA-2009-1451.html
http://www.securityfocus.com/bid/36263
http://www.vupen.com/english/advisories/2009/3184
https://lists.freeradius.org/pipermail/freeradius-users/2009-September/msg00242.html
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9919
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:freeradius:freeradius:*:*:*:*:*:*:*:*
cpe:2.3:a:freeradius:freeradius:0.2:*:*:*:*:*:*:*
cpe:2.3:a:freeradius:freeradius:0.3:*:*:*:*:*:*:*
cpe:2.3:a:freeradius:freeradius:0.4:*:*:*:*:*:*:*
cpe:2.3:a:freeradius:freeradius:0.5:*:*:*:*:*:*:*
cpe:2.3:a:freeradius:freeradius:0.8:*:*:*:*:*:*:*
cpe:2.3:a:freeradius:freeradius:0.8.1:*:*:*:*:*:*:*
cpe:2.3:a:freeradius:freeradius:0.9:*:*:*:*:*:*:*
cpe:2.3:a:freeradius:freeradius:0.9.1:*:*:*:*:*:*:*
cpe:2.3:a:freeradius:freeradius:0.9.2:*:*:*:*:*:*:*
cpe:2.3:a:freeradius:freeradius:0.9.3:*:*:*:*:*:*:*
cpe:2.3:a:freeradius:freeradius:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:freeradius:freeradius:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:freeradius:freeradius:1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:freeradius:freeradius:1.0.3:*:*:*:*:*:*:*
cpe:2.3:a:freeradius:freeradius:1.0.4:*:*:*:*:*:*:*
cpe:2.3:a:freeradius:freeradius:1.0.5:*:*:*:*:*:*:*
cpe:2.3:a:freeradius:freeradius:1.1.0:*:*:*:*:*:*:*
cpe:2.3:a:freeradius:freeradius:1.1.3:*:*:*:*:*:*:*
cpe:2.3:a:freeradius:freeradius:1.1.5:*:*:*:*:*:*:*
cpe:2.3:a:freeradius:freeradius:1.1.6:*:*:*:*:*:*:*

History

21 Nov 2024, 01:06

Type Values Removed Values Added
References () http://github.com/alandekok/freeradius-server/commit/860cad9e02ba344edb0038419e415fe05a9a01f4 - Patch () http://github.com/alandekok/freeradius-server/commit/860cad9e02ba344edb0038419e415fe05a9a01f4 - Patch
References () http://intevydis.com/vd-list.shtml - () http://intevydis.com/vd-list.shtml -
References () http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html - () http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html -
References () http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html - () http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html -
References () http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html - () http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html -
References () http://secunia.com/advisories/36509 - () http://secunia.com/advisories/36509 -
References () http://support.apple.com/kb/HT3937 - () http://support.apple.com/kb/HT3937 -
References () http://www.openwall.com/lists/oss-security/2009/09/09/1 - Patch () http://www.openwall.com/lists/oss-security/2009/09/09/1 - Patch
References () http://www.redhat.com/support/errata/RHSA-2009-1451.html - () http://www.redhat.com/support/errata/RHSA-2009-1451.html -
References () http://www.securityfocus.com/bid/36263 - () http://www.securityfocus.com/bid/36263 -
References () http://www.vupen.com/english/advisories/2009/3184 - () http://www.vupen.com/english/advisories/2009/3184 -
References () https://lists.freeradius.org/pipermail/freeradius-users/2009-September/msg00242.html - () https://lists.freeradius.org/pipermail/freeradius-users/2009-September/msg00242.html -
References () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9919 - () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9919 -

Information

Published : 2009-09-09 18:30

Updated : 2024-11-21 01:06


NVD link : CVE-2009-3111

Mitre link : CVE-2009-3111

CVE.ORG link : CVE-2009-3111


JSON object : View

Products Affected

freeradius

  • freeradius