Info

Disclosure

Sep 20, 2004

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

FreeRADIUS contains a flaw that may allow a remote denial of service. The issue is triggered when an Ascend-Send-Secret packet without an original packet occurs, and will result in loss of availability for the service.

Classification

Location: Remote / Network Access
Attack Type: Denial of Service
Impact: Loss of Availability
Exploit: Exploit Unknown
Disclosure: OSVDB Verified

Solution

Upgrade to version 1.0.1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

FreeRADIUS	FreeRADIUS	0.1
		0.2
		0.3
		0.4
		0.5
		0.6
		0.7
		0.7.1
		0.8
		0.8.1
		0.9.0
		0.9.1
		0.9.2
		0.9.3

References

Security Tracker: 1011364
Bugtraq ID: 11222
Related OSVDB ID: 11806 11807
Secunia Advisory ID: 12570 13193
ISS X-Force ID: 17440
CVE ID: 2004-0938 (see also: NVD) 2004-0960 (see also: NVD) 2004-0961 (see also: NVD)
Mail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2004-09/0596.html
Vendor Specific Advisory URL: http://security.gentoo.org/glsa/glsa-200409-29.xml
Vendor URL: http://www.freeradius.org/
Vendor Specific Solution URL: http://www.freeradius.org/security.html

Credit

Evgeny Demidov - demidovgleg.net -

Direct URL: http://osvdb.org/10178