PT-2002-1106 · Freeradius · Freeradius

Published 2002-03-04 · Updated 2018-10-30 · CVE-2001-1377

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned, so the information cannot be provided.

Description The issue concerns multiple RADIUS implementations that do not properly validate the Vendor-Length of the Vendor-Specific attribute. This allows remote attackers to cause a denial of service, resulting in a crash, by providing a Vendor-Length that is less than 2.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2001-1377

Affected Products

Freeradius

References · 10

• http://redhat.com/support/errata/RHSA-2002-030.html · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000466 · Vendor Advisory
• http://iss.net/security_center/static/8354.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1377 · Security Note
• http://archives.neohapsis.com/archives/linux/suse/2002-q2/0362.html · Vendor Advisory
• http://securityfocus.com/bid/4230 · Vendor Advisory
• http://kb.cert.org/vuls/id/936683 · Patch
• ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02:02.asc · Vendor Advisory
• http://cert.org/advisories/CA-2002-06.html · Patch
• http://marc.info/?l=bugtraq&m=101537153021792&w=2 · Note