Vulnerabilities > CVE-2003-0967 - Unspecified vulnerability in Freeradius
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
rad_decode in FreeRADIUS 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a short RADIUS string attribute with a tag, which causes memcpy to be called with a -1 length argument, as demonstrated using the Tunnel-Password attribute.
Vulnerable Configurations
Exploit-Db
| description | FreeRADIUS 0.x/1.1.x Tag Field Heap Corruption Vulnerability. CVE-2003-0967. Dos exploit for linux platform |
| id | EDB-ID:23391 |
| last seen | 2016-02-02 |
| modified | 2003-11-20 |
| published | 2003-11-20 |
| reporter | Evgeny Legerov |
| source | https://www.exploit-db.com/download/23391/ |
| title | FreeRADIUS 0.x/1.1.x Tag Field Heap Corruption Vulnerability |
Nessus
NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2009-1451.NASL description Updated freeradius packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network. An input validation flaw was discovered in the way FreeRADIUS decoded specific RADIUS attributes from RADIUS packets. A remote attacker could use this flaw to crash the RADIUS daemon (radiusd) via a specially crafted RADIUS packet. (CVE-2009-3111) Users of FreeRADIUS are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, radiusd will be restarted automatically. last seen 2020-06-01 modified 2020-06-02 plugin id 41008 published 2009-09-18 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/41008 title RHEL 5 : freeradius (RHSA-2009:1451) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2009-1451.NASL description From Red Hat Security Advisory 2009:1451 : Updated freeradius packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network. An input validation flaw was discovered in the way FreeRADIUS decoded specific RADIUS attributes from RADIUS packets. A remote attacker could use this flaw to crash the RADIUS daemon (radiusd) via a specially crafted RADIUS packet. (CVE-2009-3111) Users of FreeRADIUS are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, radiusd will be restarted automatically. last seen 2020-06-01 modified 2020-06-02 plugin id 67926 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67926 title Oracle Linux 5 : freeradius (ELSA-2009-1451) NASL family Scientific Linux Local Security Checks NASL id SL_20090917_FREERADIUS_ON_SL5_X.NASL description CVE-2009-3111 FreeRADIUS: Missing check for Tunnel-Password attributes with zero length (DoS) -- re-appearance of CVE-2003-0967 An input validation flaw was discovered in the way FreeRADIUS decoded specific RADIUS attributes from RADIUS packets. A remote attacker could use this flaw to crash the RADIUS daemon (radiusd) via a specially crafted RADIUS packet. (CVE-2009-3111) After installing the update, radiusd will be restarted automatically. last seen 2020-06-01 modified 2020-06-02 plugin id 60666 published 2012-08-01 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/60666 title Scientific Linux Security Update : freeradius on SL5.x i386/x86_64 NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2009-227.NASL description A vulnerability has been found and corrected in freeradius : The rad_decode function in FreeRADIUS before 1.1.8 allows remote attackers to cause a denial of service (radiusd crash) via zero-length Tunnel-Password attributes. NOTE: this is a regression error related to CVE-2003-0967 (CVE-2009-3111). This update provides a solution to this vulnerability. Update : Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers. last seen 2020-06-01 modified 2020-06-02 plugin id 43851 published 2010-01-12 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/43851 title Mandriva Linux Security Advisory : freeradius (MDVSA-2009:227-1) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2009-1451.NASL description Updated freeradius packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network. An input validation flaw was discovered in the way FreeRADIUS decoded specific RADIUS attributes from RADIUS packets. A remote attacker could use this flaw to crash the RADIUS daemon (radiusd) via a specially crafted RADIUS packet. (CVE-2009-3111) Users of FreeRADIUS are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, radiusd will be restarted automatically. last seen 2020-06-01 modified 2020-06-02 plugin id 43791 published 2010-01-06 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/43791 title CentOS 5 : freeradius (CESA-2009:1451) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2003-386.NASL description Updated FreeRADIUS packages are now available that fix a denial of service vulnerability. FreeRADIUS is an Internet authentication daemon, which implements the RADIUS protocol. It allows Network Access Servers (NAS boxes) to perform authentication for dial-up users. The rad_decode function in FreeRADIUS 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a short RADIUS string attribute with a tag, which causes memcpy to be called with a -1 length argument, as demonstrated using the Tunnel-Password attribute. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0967 to this issue. Users of FreeRADIUS are advised to upgrade to these erratum packages containing FreeRADIUS 0.9.3 which is not vulnerable to these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 12437 published 2004-07-06 reporter This script is Copyright (C) 2004-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/12437 title RHEL 3 : freeradius (RHSA-2003:386)
Oval
| accepted | 2013-04-29T04:09:57.832-04:00 | ||||||||
| class | vulnerability | ||||||||
| contributors |
| ||||||||
| definition_extensions |
| ||||||||
| description | rad_decode in FreeRADIUS 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a short RADIUS string attribute with a tag, which causes memcpy to be called with a -1 length argument, as demonstrated using the Tunnel-Password attribute. | ||||||||
| family | unix | ||||||||
| id | oval:org.mitre.oval:def:10917 | ||||||||
| status | accepted | ||||||||
| submitted | 2010-07-09T03:56:16-04:00 | ||||||||
| title | rad_decode in FreeRADIUS 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a short RADIUS string attribute with a tag, which causes memcpy to be called with a -1 length argument, as demonstrated using the Tunnel-Password attribute. | ||||||||
| version | 26 |
Redhat
| advisories |
| ||||
| rpms |
|
References
- http://marc.info/?l=bugtraq&m=106935911101493&w=2
- http://marc.info/?l=bugtraq&m=106944220426970
- http://marc.info/?l=freeradius-users&m=106947389449613&w=2
- http://www.redhat.com/support/errata/RHSA-2003-386.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10917
- http://marc.info/?l=bugtraq&m=106935911101493&w=2
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10917
- http://www.redhat.com/support/errata/RHSA-2003-386.html
- http://marc.info/?l=freeradius-users&m=106947389449613&w=2
- http://marc.info/?l=bugtraq&m=106944220426970