Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 284454 (CVE-2009-3111) - <net-dialup/freeradius-1.1.8 zero-length Tunnel password DoS (CVE-2009-3111)
Summary: <net-dialup/freeradius-1.1.8 zero-length Tunnel password DoS (CVE-2009-3111)
Status: RESOLVED FIXED
Alias: CVE-2009-3111
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High minor (vote)
Assignee: Gentoo Security
URL: http://github.com/alandekok/freeradiu...
Whiteboard: B3 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2009-09-10 09:52 UTC by Alex Legler (RETIRED)
Modified: 2009-09-21 19:24 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alex Legler (RETIRED) archtester gentoo-dev Security 2009-09-10 09:52:05 UTC 
CVE-2009-3111 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3111):
  The rad_decode function in FreeRADIUS before 1.1.8 allows remote
  attackers to cause a denial of service (radiusd crash) via
  zero-length Tunnel-Password attributes.  NOTE: this is a regression
  error related to CVE-2003-0967.
Comment 1 Alex Legler (RETIRED) archtester gentoo-dev Security 2009-09-10 09:52:44 UTC 
Please remove 1.1.7.
Comment 2 Alin Năstac (RETIRED) gentoo-dev 2009-09-12 04:39:22 UTC 
Done.

I tried to add version 1.1.8 to the tree, but that configure script is borked and I don't want to put time and effort in supporting ancient versions :-/
Comment 3 Stefan Behte (RETIRED) gentoo-dev Security 2009-09-14 21:51:01 UTC 
Vote: NO.
Comment 4 Alex Legler (RETIRED) archtester gentoo-dev Security 2009-09-21 19:24:18 UTC 
NO. Closing.