Published: 17/07/2017 Updated: 03/10/2019

CVSS v2 Base Score: 7.8 | Impact Score: 6.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 694

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

An FR-GV-302 issue in FreeRADIUS 3.x prior to 3.0.15 allows "Infinite loop and memory exhaustion with 'concat' attributes" and a denial of service.

Vulnerable Product	Search on Vulmon	Subscribe to Product
freeradius freeradius 3.0.11
freeradius freeradius 3.0.10
freeradius freeradius 3.0.2
freeradius freeradius 3.0.1
freeradius freeradius 3.0.9
freeradius freeradius 3.0.8
freeradius freeradius 3.0.7
freeradius freeradius 3.0.0
freeradius freeradius 3.0.14
freeradius freeradius 3.0.6
freeradius freeradius 3.0.5
freeradius freeradius 3.0.13
freeradius freeradius 3.0.12
freeradius freeradius 3.0.4
freeradius freeradius 3.0.3

Debian Bug report logs - #868765 freeradius: New upstream version 3015 fixing security critical bugs Package: freeradius; Maintainer for freeradius is Debian FreeRADIUS Packaging Team <pkg-freeradius-maintainers@listsaliothdebianorg>; Source for freeradius is src:freeradius (PTS, buildd, popcon) Reported by: Karsten Hey ...

Several security issues were fixed in FreeRADIUS ...

Guido Vranken discovered that FreeRADIUS, an open source implementation of RADIUS, the IETF protocol for AAA (Authorisation, Authentication, and Accounting), did not properly handle memory when processing packets This would allow a remote attacker to cause a denial-of-service by application crash, or potentially execute arbitrary code All those i ...

A denial of service flaw was found in the way FreeRADIUS server handled certain attributes in request packets A remote attacker could use this flaw to cause the FreeRADIUS server to enter an infinite loop, consume increasing amounts of memory resources, and ultimately crash by sending a specially crafted request packet ...

A security issue has been found in freeradius <= 3015, where the server could go into an infinite loop and exhaust memory when it receives zero-length attributes marked 'concat' in the dictionaries ...

CWE-835 http://freeradius.org/security/fuzzer-2017.html http://www.securityfocus.com/bid/99968 http://www.debian.org/security/2017/dsa-3930 https://access.redhat.com/errata/RHSA-2017:2389 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=868765 https://usn.ubuntu.com/3369-1/https://nvd.nist.gov

CVE-2017-10985

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect