PT-2004-1910 · Gnu · Gnu Radius

Published 2004-09-17 · Updated 2017-07-11 · CVE-2004-0849

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: GNU Radius versions 1.1 and 1.2 before 1.2.94

Description: The issue is related to an integer overflow in the asn decode string() function, which can be triggered by certain SNMP requests, leading to a denial of service (daemon crash). This occurs when GNU Radius is compiled with the --enable-snmp option.

Recommendations: For GNU Radius versions 1.1 and 1.2 before 1.2.94, update to version 1.2.94 or later to resolve the issue.

Fix

Related Identifiers

CVE-2004-0849

Affected Products

Gnu Radius

References · 4

• http://lists.gnu.org/archive/html/info-gnu-radius/2004-09/msg00000.html · Vendor Advisory
• http://idefense.com/application/poi/display?id=141&type=vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0849 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17391 · Note