BID:23466

FreeRadius EAP-TTLS Tunnel Memory Leak Remote Denial Of Service Vulnerability

Info

FreeRadius EAP-TTLS Tunnel Memory Leak Remote Denial Of Service Vulnerability

Bugtraq ID:	23466
Class:	Design Error
CVE:	CVE-2007-2028
Remote:	Yes
Local:	No
Published:	Apr 12 2007 12:00AM
Updated:	May 25 2007 05:31PM
Credit:	This vulnerability was discovered by the Coverity Project.
Vulnerable:	Trustix Secure Linux 3.0.5 Trustix Secure Linux 3.0 SuSE SUSE Linux Enterprise Server 8 + Linux kernel 2.4.21 + Linux kernel 2.4.19 SuSE SUSE Linux Enterprise Server 10 SuSE SUSE Linux Enterprise Desktop 10 SuSE Linux Professional 10.2 x86_64 SuSE Linux Personal 10.2 x86_64 SGI ProPack 3.0 SP6 S.u.S.E. UnitedLinux 1.0 S.u.S.E. SuSE Linux Standard Server 8.0 S.u.S.E. SuSE Linux School Server for i386 S.u.S.E. SUSE LINUX Retail Solution 8.0 S.u.S.E. SuSE Linux Openexchange Server 4.0 S.u.S.E. openSUSE 10.2 S.u.S.E. Open-Enterprise-Server 9.0 S.u.S.E. Novell Linux Desktop 9.0 S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 9.3 x86_64 S.u.S.E. Linux Professional 9.3 S.u.S.E. Linux Professional 9.2 x86_64 S.u.S.E. Linux Professional 9.2 S.u.S.E. Linux Professional 9.1 x86_64 S.u.S.E. Linux Professional 9.1 S.u.S.E. Linux Professional 9.0 x86_64 S.u.S.E. Linux Professional 9.0 S.u.S.E. Linux Professional 10.2 S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 10.0 OSS S.u.S.E. Linux Personal 9.3 x86_64 S.u.S.E. Linux Personal 9.3 S.u.S.E. Linux Personal 9.2 x86_64 S.u.S.E. Linux Personal 9.2 S.u.S.E. Linux Personal 9.1 x86_64 S.u.S.E. Linux Personal 9.1 S.u.S.E. Linux Personal 9.0 x86_64 S.u.S.E. Linux Personal 10.2 S.u.S.E. Linux Personal 10.1 S.u.S.E. Linux Enterprise Server 9 S.u.S.E. Linux Desktop 1.0 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux WS 3 RedHat Enterprise Linux ES 4 RedHat Enterprise Linux ES 3 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux AS 4 Red Hat Enterprise Linux AS 3 Red Hat Enterprise Linux 5 Server Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0 Gentoo Linux FreeRADIUS FreeRADIUS 1.1.5 FreeRADIUS FreeRADIUS 1.1.4 FreeRADIUS FreeRADIUS 1.1.3 FreeRADIUS FreeRADIUS 1.1.2 FreeRADIUS FreeRADIUS 1.1.1 FreeRADIUS FreeRADIUS 1.1 FreeRADIUS FreeRADIUS 1.0.5 FreeRADIUS FreeRADIUS 1.0.4 FreeRADIUS FreeRADIUS 1.0.3 FreeRADIUS FreeRADIUS 1.0.2 + Gentoo Linux FreeRADIUS FreeRADIUS 1.0.1 FreeRADIUS FreeRADIUS 1.0 FreeRADIUS FreeRADIUS 0.9.3 FreeRADIUS FreeRADIUS 0.9.2 FreeRADIUS FreeRADIUS 0.9.1 FreeRADIUS FreeRADIUS 0.9 FreeRADIUS FreeRADIUS 0.8.1 FreeRADIUS FreeRADIUS 0.8 FreeRADIUS FreeRADIUS 0.5 FreeRADIUS FreeRADIUS 0.4 FreeRADIUS FreeRADIUS 0.3 FreeRADIUS FreeRADIUS 0.3 FreeRADIUS FreeRADIUS 0.2

Not Vulnerable:	FreeRADIUS FreeRADIUS 1.1.6

Discussion

FreeRadius EAP-TTLS Tunnel Memory Leak Remote Denial Of Service Vulnerability

FreeRADIUS is prone to a denial-of-service vulnerability.

This vulnerability presents itself when an attacker sends malformed data inside an EAP-TTLS tunnel.

Exploit / POC

FreeRadius EAP-TTLS Tunnel Memory Leak Remote Denial Of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Solution / Fix

FreeRadius EAP-TTLS Tunnel Memory Leak Remote Denial Of Service Vulnerability

Solution:
The vendor has released version 1.1.6 to address this issue; please see the references for more information and fixes.

FreeRADIUS FreeRADIUS 0.2