A security issue has been found in freeradius <= 3.0.15, where the fr_dhcp_decode() function performed a strcmp() on binary data in an internal data structure, instead of checking the length of the option and doing a memcmp. A remote attacker with the ability to send packets which are accepted by the server can make the server read its memory until it reaches a zero byte or crashes, causing a denial of service.
A security issue has been found in freeradius <= 3.0.15, where the fr_dhcp_decode() function performed a strcmp() on binary data in an internal data structure, instead of checking the length of the option and doing a memcmp. A remote attacker with the ability to send packets which are accepted by the server can make the server read its memory until it reaches a zero byte or crashes, causing a denial of service.
http://freeradius.org/security/fuzzer-2017.html#FR-GV-206 https://github.com/FreeRADIUS/freeradius-server/commit/5759b20af99af6d30924f0efd8da5eac2a17163d
Vulmon