Multiple Vendor RADIUS Digest Calculation Buffer Overflow Vulnerability

BID:3530

Info

Multiple Vendor RADIUS Digest Calculation Buffer Overflow Vulnerability

Bugtraq ID: 3530
Class: Boundary Condition Error
CVE: CVE-2001-1376
Remote: Yes
Local: No
Published: Nov 13 2001 12:00AM
Updated: Jul 11 2009 09:06AM
Credit: This issue was initially reported by 3APA3A <[email protected]>.
Vulnerable: Yard RADIUS Yard RADIUS 1.0.19
Yard RADIUS Yard RADIUS 1.0.18
Yard RADIUS Yard RADIUS 1.0.17
Yard RADIUS Yard RADIUS 1.0.16
Yard RADIUS Yard RADIUS 1.0 pre15
Yard RADIUS Yard RADIUS 1.0 pre14
Yard RADIUS Yard RADIUS 1.0 pre13
XTRadius XTRadius 1.1 -pre1
RADIUSClient RADIUSClient 0.3.1
OpenRADIUS OpenRADIUS 0.9.3
OpenRADIUS OpenRADIUS 0.9.2
OpenRADIUS OpenRADIUS 0.9.1
OpenRADIUS OpenRADIUS 0.9
OpenRADIUS OpenRADIUS 0.8
Miquel van Smoorenburg Cistron Radius 1.6.5
- FreeBSD FreeBSD 4.5
- FreeBSD FreeBSD 4.4
- FreeBSD FreeBSD 4.3
- FreeBSD FreeBSD 4.2
- FreeBSD FreeBSD 4.1.1
- Redhat Linux 7.1 i386
 - Redhat Linux 7.1 alpha
 - Redhat Linux 7.0 i386
 - Redhat Linux 7.0 alpha
 Miquel van Smoorenburg Cistron Radius 1.6.4
+ SuSE Linux 7.3 sparc
 + SuSE Linux 7.3 ppc
 + SuSE Linux 7.3 i386
 + SuSE Linux 7.2 i386
 + SuSE Linux 7.1 x86
 + SuSE Linux 7.1 sparc
 + SuSE Linux 7.1 ppc
 + SuSE Linux 7.1 alpha
 Miquel van Smoorenburg Cistron Radius 1.6.3
+ SuSE Linux 7.0 sparc
 + SuSE Linux 7.0 ppc
 + SuSE Linux 7.0 i386
 + SuSE Linux 7.0 alpha
 Miquel van Smoorenburg Cistron Radius 1.6.2
+ SuSE Linux 6.4 ppc
 + SuSE Linux 6.4 i386
 + SuSE Linux 6.4 alpha
 Miquel van Smoorenburg Cistron Radius 1.6.1
Miquel van Smoorenburg Cistron Radius 1.6 .0
Lucent RADIUS 2.1
Lucent RADIUS 2.0 1
Lucent RADIUS 2.0
Livingston RADIUS 2.1
Livingston RADIUS 2.0.1
Livingston RADIUS 2.0
ICRadius ICRADIUS 0.18.1
ICRadius ICRADIUS 0.18
ICRadius ICRADIUS 0.17 b
ICRadius ICRADIUS 0.17
ICRadius ICRADIUS 0.16
ICRadius ICRADIUS 0.15
ICRadius ICRADIUS 0.14
- Larry Wall Perl 5.0 05
 - Larry Wall Perl 5.0 05
 - Larry Wall Perl 5.0 05
 - MySQL AB MySQL 3.23.10
GNU Radius 0.95
GNU Radius 0.94
GNU Radius 0.93
GNU Radius 0.92.1
FreeRADIUS FreeRADIUS 0.3
FreeRADIUS FreeRADIUS 0.3
FreeRADIUS FreeRADIUS 0.2
Ascend RADIUS 1.16
- FreeBSD FreeBSD 4.5
- FreeBSD FreeBSD 4.4
- FreeBSD FreeBSD 4.3
- FreeBSD FreeBSD 4.2
- FreeBSD FreeBSD 4.1.1
Not Vulnerable: Yard RADIUS Yard RADIUS 1.0.20
+ Debian Linux 3.0 sparc
 + Debian Linux 3.0 s/390
 + Debian Linux 3.0 ppc
 + Debian Linux 3.0 mipsel
 + Debian Linux 3.0 mips
 + Debian Linux 3.0 m68k
 + Debian Linux 3.0 ia-64
 + Debian Linux 3.0 ia-32
 + Debian Linux 3.0 hppa
 + Debian Linux 3.0 arm
 + Debian Linux 3.0 alpha
 + Debian Linux 3.0
XTRadius XTRadius 1.2.1 beta
XTRadius XTRadius 1.1 -pre2
RADIUSClient RADIUSClient 0.3.2
OpenRADIUS OpenRADIUS 0.9.4
Miquel van Smoorenburg Cistron Radius 1.6.6
- Redhat Linux 7.1 i386
 - Redhat Linux 7.1 alpha
 - Redhat Linux 7.0 i386
 - Redhat Linux 7.0 alpha
 + SuSE Linux 8.0
Miquel van Smoorenburg Cistron Radius 1.6.5
- FreeBSD FreeBSD 4.5
- FreeBSD FreeBSD 4.4
- FreeBSD FreeBSD 4.3
- FreeBSD FreeBSD 4.2
- FreeBSD FreeBSD 4.1.1
- Redhat Linux 7.1 i386
 - Redhat Linux 7.1 alpha
 - Redhat Linux 7.0 i386
 - Redhat Linux 7.0 alpha
 GNU Radius 0.96
FreeRADIUS FreeRADIUS 0.5
FreeRADIUS FreeRADIUS 0.4
Cisco Secure ACS for Windows NT 3.0

Exploit / POC

Multiple Vendor RADIUS Digest Calculation Buffer Overflow Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] &lt;mailto:[email protected]&gt;.

Solution / Fix

Multiple Vendor RADIUS Digest Calculation Buffer Overflow Vulnerability

Solution:
A number of vendors have made upgrades available.


FreeRADIUS FreeRADIUS 0.2

FreeRADIUS FreeRADIUS 0.3

FreeRADIUS FreeRADIUS 0.3

RADIUSClient RADIUSClient 0.3.1

OpenRADIUS OpenRADIUS 0.8

OpenRADIUS OpenRADIUS 0.9

OpenRADIUS OpenRADIUS 0.9.1

OpenRADIUS OpenRADIUS 0.9.2

OpenRADIUS OpenRADIUS 0.9.3

GNU Radius 0.92.1

GNU Radius 0.93

GNU Radius 0.94

GNU Radius 0.95

Yard RADIUS Yard RADIUS 1.0 pre14

Yard RADIUS Yard RADIUS 1.0 pre15

Yard RADIUS Yard RADIUS 1.0 pre13

Yard RADIUS Yard RADIUS 1.0.16

Yard RADIUS Yard RADIUS 1.0.17

Yard RADIUS Yard RADIUS 1.0.18

Yard RADIUS Yard RADIUS 1.0.19

XTRadius XTRadius 1.1 -pre1

Miquel van Smoorenburg Cistron Radius 1.6 .0

Miquel van Smoorenburg Cistron Radius 1.6.1

Miquel van Smoorenburg Cistron Radius 1.6.2

Miquel van Smoorenburg Cistron Radius 1.6.3

Miquel van Smoorenburg Cistron Radius 1.6.4

Miquel van Smoorenburg Cistron Radius 1.6.5

Lucent RADIUS 2.1

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report