GNU Radius SNMP OID Remote Denial Of Service Vulnerability

Bugtraq ID:	10582
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2004-0576
Remote:	Yes
Local:	No
Published:	Jun 21 2004 12:00AM
Updated:	Jul 12 2009 05:16AM
Credit:	The discoverer of this vulnerability wishes to remain anonymous.
Vulnerable:	GNU Radius 1.1
Not Vulnerable:	GNU Radius 1.2

GNU Radius SNMP OID Remote Denial Of Service Vulnerability

GNU Radius is reported prone to a remote denial of service vulnerability. The issue is reported to present itself when GNU Radius handles SNMP messages that contain invalid Object ID data. It is reported that this vulnerability will exist only when the affected Radius server is compiled with the '-enable-snmp' option.

GNU Radius SNMP OID Remote Denial Of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

GNU Radius SNMP OID Remote Denial Of Service Vulnerability

Solution:
The vendor has released GNU Radius version 1.2 to address this issue:


GNU Radius 1.1

• GNU radius-1.2.tar.gz
  http://ftp.gnu.org/gnu/radius/radius-1.2.tar.gz

GNU Radius SNMP OID Remote Denial Of Service Vulnerability

References:

• GNU Radius SNMP Invalid OID Denial of Service Vulnerability (iDEFENSE)
  
• Radius Homepage (GNU)