Vulnerabilities > CVE-2001-1377 - Denial Of Service vulnerability in Multiple Vendor Radius Short Vendor-Length Field

CVSS 5.0 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

PARTIAL

network

low complexity

miquel-van-smoorenburg-cistron

yard-radius-project

NVD

Published: 2002-03-04

Updated: 2018-10-30

Summary

Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers to cause a denial of service (crash) via a Vendor-Length that is less than 2.

Vulnerable Configurations

Part	Description	Count
Application	Freeradius Freeradius Freeradius 0.2 Freeradius Freeradius 0.3	2
Application	Gnu GNU Radius 0.92.1 GNU Radius 0.93 GNU Radius 0.94 GNU Radius 0.95	4
Application	Icradius Icradius Icradius 0.14 Icradius Icradius 0.15 Icradius Icradius 0.16 Icradius Icradius 0.17 Icradius Icradius 0.17B Icradius Icradius 0.18 Icradius Icradius 0.18.1	7
Application	Livingston Livingston Radius 2.0 Livingston Radius 2.0.1 Livingston Radius 2.1	3
Application	Lucent Lucent Radius 2.0 Lucent Radius 2.0.1 Lucent Radius 2.1	3
Application	Miquel_Van_Smoorenburg_Cistron Miquel VAN Smoorenburg Cistron Radius 1.6.1 Miquel VAN Smoorenburg Cistron Radius 1.6.2 Miquel VAN Smoorenburg Cistron Radius 1.6.3 Miquel VAN Smoorenburg Cistron Radius 1.6.4 Miquel VAN Smoorenburg Cistron Radius 1.6.5 Miquel VAN Smoorenburg Cistron Radius 1.6_.0	6
Application	Openradius Openradius Openradius 0.8 Openradius Openradius 0.9 Openradius Openradius 0.9.1 Openradius Openradius 0.9.2 Openradius Openradius 0.9.3	5
Application	Radiusclient Radiusclient Radiusclient 0.3.1	1
Application	Xtradius Xtradius Xtradius 1.1_Pre1 Xtradius Xtradius 1.1_Pre2	2
Application	Yard_Radius Yard Radius Yard Radius 1.0.17 Yard Radius Yard Radius 1.0.18 Yard Radius Yard Radius 1.0.19 Yard Radius Yard Radius 1.0_Pre13 Yard Radius Yard Radius 1.0_Pre14 Yard Radius Yard Radius 1.0_Pre15	6
Application	Yard_Radius_Project Yard Radius Project Yard Radius 1.0.16	1

Redhat

advisories

rhsa

id	RHSA-2002:030

References

CVE is a registered MITRE Corporation trademark and MITRE's CVE website is the authoritative source of CVE content. CWE is a registered MITRE Corporation trademark and MITRE's CWE website is the authoritative source of CWE content.