PT-2007-1565 · Freeradius · Freeradius

Published 2007-01-05 · Updated 2024-08-07 · CVE-2007-0080

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Medium

Base vector

AV:L/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreeRadius versions 1.1.3 and earlier

Description A buffer overflow issue in the SMB Connect Server function allows attackers to execute arbitrary code related to the desthost field of an SMB Handle Type instance. The impact of this issue has been disputed, with the vendor stating that exploitation is limited to local administrators who have write access to the server configuration files.

Recommendations For FreeRadius versions 1.1.3 and earlier, consider restricting access to the server configuration files to minimize the risk of exploitation. As a temporary workaround, limit write access to these files to only necessary administrators. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-0080

Affected Products

Freeradius

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2007-0080 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2007-0080 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-0080 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-0080 · Vendor Advisory
• http://securityfocus.com/archive/1/455812/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31248 · Note
• http://osvdb.org/32082 · Note
• https://t.me/cvenotify/89618 · Telegram Post
• http://freeradius.org/security.html · Note
• http://securitytracker.com/id?1017463 · Note
• http://securityfocus.com/archive/1/455678/100/0/threaded · Note
• http://attrition.org/pipermail/vim/2007-February/001304.html · Note