FreeRADIUS Zero-length Tunnel-Password Attributes Denial of Service Vulnerability
BID:36263
Info
FreeRADIUS Zero-length Tunnel-Password Attributes Denial of Service Vulnerability
| Bugtraq ID: | 36263 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-3111 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 03 2009 12:00AM |
| Updated: | Jan 11 2010 05:41PM |
| Credit: | Intevydis |
| Vulnerable: |
Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 10 SP2 SuSE Linux 9 SuSE Linux 11 SuSE Linux 10.0 S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.3 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux 5 Server Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0 FreeRADIUS FreeRADIUS 1.1.7 Apple Mac OS X Server 10.5.8 Apple Mac OS X Server 10.5.7 Apple Mac OS X Server 10.5.6 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.4.11 Apple Mac OS X Server 10.4.11 Apple Mac OS X Server 10.4.10 Apple Mac OS X Server 10.4.9 Apple Mac OS X Server 10.4.8 Apple Mac OS X Server 10.4.7 Apple Mac OS X Server 10.4.6 Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X Server 10.3.9 Apple Mac OS X Server 10.3.8 Apple Mac OS X Server 10.3.7 Apple Mac OS X Server 10.3.6 Apple Mac OS X Server 10.3.5 Apple Mac OS X Server 10.3.4 Apple Mac OS X Server 10.3.3 Apple Mac OS X Server 10.3.2 Apple Mac OS X Server 10.3.1 Apple Mac OS X Server 10.3 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.8 Apple Mac OS X 10.5.7 Apple Mac OS X 10.5.6 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.4.11 Apple Mac OS X 10.4.11 Apple Mac OS X 10.4.10 Apple Mac OS X 10.4.9 Apple Mac OS X 10.4.8 Apple Mac OS X 10.4.7 Apple Mac OS X 10.4.6 Apple Mac OS X 10.4.5 Apple Mac OS X 10.4.4 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4 Apple Mac OS X 10.3.9 Apple Mac OS X 10.3.8 Apple Mac OS X 10.3.7 Apple Mac OS X 10.3.6 Apple Mac OS X 10.3.5 Apple Mac OS X 10.3.4 Apple Mac OS X 10.3.3 Apple Mac OS X 10.3.2 Apple Mac OS X 10.3.1 Apple Mac OS X 10.3 Apple Mac OS X 10.5 |
| Not Vulnerable: |
FreeRADIUS FreeRADIUS 1.1.8 Apple Mac OS X Server 10.6.2 Apple Mac OS X 10.6.2 |
Discussion
FreeRADIUS Zero-length Tunnel-Password Attributes Denial of Service Vulnerability
FreeRADIUS is prone to a denial-of-service vulnerability.
An attacker can exploit this issue to crash the effected application, denying service to legitimate users.
Versions prior to FreeRADIUS 1.1.8 are vulnerable.
FreeRADIUS is prone to a denial-of-service vulnerability.
An attacker can exploit this issue to crash the effected application, denying service to legitimate users.
Versions prior to FreeRADIUS 1.1.8 are vulnerable.
Exploit / POC
FreeRADIUS Zero-length Tunnel-Password Attributes Denial of Service Vulnerability
A working commercial exploit is available through Intevydis. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following exploit is available:
A working commercial exploit is available through Intevydis. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following exploit is available:
Solution / Fix
FreeRADIUS Zero-length Tunnel-Password Attributes Denial of Service Vulnerability
Solution:
Updates are available. Please see the references for more information.
Ubuntu Ubuntu Linux 8.04 LTS powerpc
Ubuntu Ubuntu Linux 8.04 LTS sparc
Mandriva Linux Mandrake 2008.0 x86_64
Ubuntu Ubuntu Linux 8.04 LTS amd64
Mandriva Linux Mandrake 2008.0
Ubuntu Ubuntu Linux 8.04 LTS lpia
MandrakeSoft Corporate Server 4.0
Ubuntu Ubuntu Linux 8.04 LTS i386
Apple Mac OS X Server 10.5.8
Apple Mac OS X 10.5.8
MandrakeSoft Corporate Server 4.0 x86_64
Solution:
Updates are available. Please see the references for more information.
Ubuntu Ubuntu Linux 8.04 LTS powerpc
-
Ubuntu freeradius-dbg_1.1.7-1ubuntu0.2_powerpc.deb
http://ports.ubuntu.com/pool/main/f/freeradius/freeradius-dbg_1.1.7-1u buntu0.2_powerpc.deb -
Ubuntu freeradius-dialupadmin_1.1.7-1ubuntu0.2_all.deb
http://security.ubuntu.com/ubuntu/pool/main/f/freeradius/freeradius-di alupadmin_1.1.7-1ubuntu0.2_all.deb -
Ubuntu freeradius-iodbc_1.1.7-1ubuntu0.2_powerpc.deb
http://ports.ubuntu.com/pool/main/f/freeradius/freeradius-iodbc_1.1.7- 1ubuntu0.2_powerpc.deb -
Ubuntu freeradius-krb5_1.1.7-1ubuntu0.2_powerpc.deb
http://ports.ubuntu.com/pool/main/f/freeradius/freeradius-krb5_1.1.7-1 ubuntu0.2_powerpc.deb -
Ubuntu freeradius-ldap_1.1.7-1ubuntu0.2_powerpc.deb
http://ports.ubuntu.com/pool/main/f/freeradius/freeradius-ldap_1.1.7-1 ubuntu0.2_powerpc.deb -
Ubuntu freeradius-mysql_1.1.7-1ubuntu0.2_powerpc.deb
http://ports.ubuntu.com/pool/main/f/freeradius/freeradius-mysql_1.1.7- 1ubuntu0.2_powerpc.deb -
Ubuntu freeradius-postgresql_1.1.7-1ubuntu0.2_powerpc.deb
http://ports.ubuntu.com/pool/main/f/freeradius/freeradius-postgresql_1 .1.7-1ubuntu0.2_powerpc.deb -
Ubuntu freeradius_1.1.7-1ubuntu0.2_powerpc.deb
http://ports.ubuntu.com/pool/main/f/freeradius/freeradius_1.1.7-1ubunt u0.2_powerpc.deb
Ubuntu Ubuntu Linux 8.04 LTS sparc
-
Ubuntu freeradius-dbg_1.1.7-1ubuntu0.2_sparc.deb
http://ports.ubuntu.com/pool/main/f/freeradius/freeradius-dbg_1.1.7-1u buntu0.2_sparc.deb -
Ubuntu freeradius-dialupadmin_1.1.7-1ubuntu0.2_all.deb
http://security.ubuntu.com/ubuntu/pool/main/f/freeradius/freeradius-di alupadmin_1.1.7-1ubuntu0.2_all.deb -
Ubuntu freeradius-iodbc_1.1.7-1ubuntu0.2_sparc.deb
http://ports.ubuntu.com/pool/main/f/freeradius/freeradius-iodbc_1.1.7- 1ubuntu0.2_sparc.deb -
Ubuntu freeradius-krb5_1.1.7-1ubuntu0.2_sparc.deb
http://ports.ubuntu.com/pool/main/f/freeradius/freeradius-krb5_1.1.7-1 ubuntu0.2_sparc.deb -
Ubuntu freeradius-ldap_1.1.7-1ubuntu0.2_sparc.deb
http://ports.ubuntu.com/pool/main/f/freeradius/freeradius-ldap_1.1.7-1 ubuntu0.2_sparc.deb -
Ubuntu freeradius-mysql_1.1.7-1ubuntu0.2_sparc.deb
http://ports.ubuntu.com/pool/main/f/freeradius/freeradius-mysql_1.1.7- 1ubuntu0.2_sparc.deb -
Ubuntu freeradius-postgresql_1.1.7-1ubuntu0.2_sparc.deb
http://ports.ubuntu.com/pool/main/f/freeradius/freeradius-postgresql_1 .1.7-1ubuntu0.2_sparc.deb -
Ubuntu freeradius_1.1.7-1ubuntu0.2_sparc.deb
http://ports.ubuntu.com/pool/main/f/freeradius/freeradius_1.1.7-1ubunt u0.2_sparc.deb
Mandriva Linux Mandrake 2008.0 x86_64
-
Mandriva freeradius-1.1.7-2.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva lib64freeradius1-1.1.7-2.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva lib64freeradius1-devel-1.1.7-2.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva lib64freeradius1-krb5-1.1.7-2.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva lib64freeradius1-ldap-1.1.7-2.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva lib64freeradius1-mysql-1.1.7-2.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva lib64freeradius1-postgresql-1.1.7-2.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva lib64freeradius1-unixODBC-1.1.7-2.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/
Ubuntu Ubuntu Linux 8.04 LTS amd64
-
Ubuntu freeradius-dbg_1.1.7-1ubuntu0.2_amd64.deb
http://security.ubuntu.com/ubuntu/pool/main/f/freeradius/freeradius-db g_1.1.7-1ubuntu0.2_amd64.deb -
Ubuntu freeradius-dialupadmin_1.1.7-1ubuntu0.2_all.deb
http://security.ubuntu.com/ubuntu/pool/main/f/freeradius/freeradius-di alupadmin_1.1.7-1ubuntu0.2_all.deb -
Ubuntu freeradius-iodbc_1.1.7-1ubuntu0.2_amd64.deb
http://security.ubuntu.com/ubuntu/pool/main/f/freeradius/freeradius-io dbc_1.1.7-1ubuntu0.2_amd64.deb -
Ubuntu freeradius-krb5_1.1.7-1ubuntu0.2_amd64.deb
http://security.ubuntu.com/ubuntu/pool/main/f/freeradius/freeradius-kr b5_1.1.7-1ubuntu0.2_amd64.deb -
Ubuntu freeradius-ldap_1.1.7-1ubuntu0.2_amd64.deb
http://security.ubuntu.com/ubuntu/pool/main/f/freeradius/freeradius-ld ap_1.1.7-1ubuntu0.2_amd64.deb -
Ubuntu freeradius-mysql_1.1.7-1ubuntu0.2_amd64.deb
http://security.ubuntu.com/ubuntu/pool/main/f/freeradius/freeradius-my sql_1.1.7-1ubuntu0.2_amd64.deb -
Ubuntu freeradius-postgresql_1.1.7-1ubuntu0.2_amd64.deb
http://security.ubuntu.com/ubuntu/pool/main/f/freeradius/freeradius-po stgresql_1.1.7-1ubuntu0.2_amd64.deb -
Ubuntu freeradius_1.1.7-1ubuntu0.2_amd64.deb
http://security.ubuntu.com/ubuntu/pool/main/f/freeradius/freeradius_1. 1.7-1ubuntu0.2_amd64.deb
Mandriva Linux Mandrake 2008.0
-
Mandriva freeradius-1.1.7-2.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libfreeradius1-1.1.7-2.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libfreeradius1-devel-1.1.7-2.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libfreeradius1-krb5-1.1.7-2.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libfreeradius1-ldap-1.1.7-2.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libfreeradius1-mysql-1.1.7-2.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libfreeradius1-postgresql-1.1.7-2.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libfreeradius1-unixODBC-1.1.7-2.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/
Ubuntu Ubuntu Linux 8.04 LTS lpia
-
Ubuntu freeradius-dbg_1.1.7-1ubuntu0.2_lpia.deb
http://ports.ubuntu.com/pool/main/f/freeradius/freeradius-dbg_1.1.7-1u buntu0.2_lpia.deb -
Ubuntu freeradius-dialupadmin_1.1.7-1ubuntu0.2_all.deb
http://security.ubuntu.com/ubuntu/pool/main/f/freeradius/freeradius-di alupadmin_1.1.7-1ubuntu0.2_all.deb -
Ubuntu freeradius-iodbc_1.1.7-1ubuntu0.2_lpia.deb
http://ports.ubuntu.com/pool/main/f/freeradius/freeradius-iodbc_1.1.7- 1ubuntu0.2_lpia.deb -
Ubuntu freeradius-krb5_1.1.7-1ubuntu0.2_lpia.deb
http://ports.ubuntu.com/pool/main/f/freeradius/freeradius-krb5_1.1.7-1 ubuntu0.2_lpia.deb -
Ubuntu freeradius-ldap_1.1.7-1ubuntu0.2_lpia.deb
http://ports.ubuntu.com/pool/main/f/freeradius/freeradius-ldap_1.1.7-1 ubuntu0.2_lpia.deb -
Ubuntu freeradius-mysql_1.1.7-1ubuntu0.2_lpia.deb
http://ports.ubuntu.com/pool/main/f/freeradius/freeradius-mysql_1.1.7- 1ubuntu0.2_lpia.deb -
Ubuntu freeradius-postgresql_1.1.7-1ubuntu0.2_lpia.deb
http://ports.ubuntu.com/pool/main/f/freeradius/freeradius-postgresql_1 .1.7-1ubuntu0.2_lpia.deb -
Ubuntu freeradius_1.1.7-1ubuntu0.2_lpia.deb
http://ports.ubuntu.com/pool/main/f/freeradius/freeradius_1.1.7-1ubunt u0.2_lpia.deb
MandrakeSoft Corporate Server 4.0
-
Mandriva freeradius-1.0.4-2.5.20060mlcs4.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libfreeradius1-1.0.4-2.5.20060mlcs4.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libfreeradius1-devel-1.0.4-2.5.20060mlcs4.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libfreeradius1-krb5-1.0.4-2.5.20060mlcs4.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libfreeradius1-ldap-1.0.4-2.5.20060mlcs4.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libfreeradius1-mysql-1.0.4-2.5.20060mlcs4.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libfreeradius1-postgresql-1.0.4-2.5.20060mlcs4.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libfreeradius1-unixODBC-1.0.4-2.5.20060mlcs4.i586.rpm
http://www.mandriva.com/en/download/
Ubuntu Ubuntu Linux 8.04 LTS i386
-
Ubuntu freeradius-dbg_1.1.7-1ubuntu0.2_i386.deb
http://security.ubuntu.com/ubuntu/pool/main/f/freeradius/freeradius-db g_1.1.7-1ubuntu0.2_i386.deb -
Ubuntu freeradius-dialupadmin_1.1.7-1ubuntu0.2_all.deb
http://security.ubuntu.com/ubuntu/pool/main/f/freeradius/freeradius-di alupadmin_1.1.7-1ubuntu0.2_all.deb -
Ubuntu freeradius-iodbc_1.1.7-1ubuntu0.2_i386.deb
http://security.ubuntu.com/ubuntu/pool/main/f/freeradius/freeradius-io dbc_1.1.7-1ubuntu0.2_i386.deb -
Ubuntu freeradius-krb5_1.1.7-1ubuntu0.2_i386.deb
http://security.ubuntu.com/ubuntu/pool/main/f/freeradius/freeradius-kr b5_1.1.7-1ubuntu0.2_i386.deb -
Ubuntu freeradius-ldap_1.1.7-1ubuntu0.2_i386.deb
http://security.ubuntu.com/ubuntu/pool/main/f/freeradius/freeradius-ld ap_1.1.7-1ubuntu0.2_i386.deb -
Ubuntu freeradius-mysql_1.1.7-1ubuntu0.2_i386.deb
http://security.ubuntu.com/ubuntu/pool/main/f/freeradius/freeradius-my sql_1.1.7-1ubuntu0.2_i386.deb -
Ubuntu freeradius-postgresql_1.1.7-1ubuntu0.2_i386.deb
http://security.ubuntu.com/ubuntu/pool/main/f/freeradius/freeradius-po stgresql_1.1.7-1ubuntu0.2_i386.deb -
Ubuntu freeradius_1.1.7-1ubuntu0.2_i386.deb
http://security.ubuntu.com/ubuntu/pool/main/f/freeradius/freeradius_1. 1.7-1ubuntu0.2_i386.deb
Apple Mac OS X Server 10.5.8
-
Apple SecUpdSrvr2009-006.dmg
For Mac OS X Server v10.5.8
http://www.apple.com/support/downloads/
Apple Mac OS X 10.5.8
-
Apple SecUpd2009-006.dmg
For Mac OS X v10.5.8
http://www.apple.com/support/downloads/
MandrakeSoft Corporate Server 4.0 x86_64
-
Mandriva freeradius-1.0.4-2.5.20060mlcs4.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva lib64freeradius1-1.0.4-2.5.20060mlcs4.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva lib64freeradius1-devel-1.0.4-2.5.20060mlcs4.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva lib64freeradius1-krb5-1.0.4-2.5.20060mlcs4.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva lib64freeradius1-ldap-1.0.4-2.5.20060mlcs4.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva lib64freeradius1-mysql-1.0.4-2.5.20060mlcs4.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva lib64freeradius1-postgresql-1.0.4-2.5.20060mlcs4.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva lib64freeradius1-unixODBC-1.0.4-2.5.20060mlcs4.x86_64.rpm
http://www.mandriva.com/en/download/
References
FreeRADIUS Zero-length Tunnel-Password Attributes Denial of Service Vulnerability
References:
References:
- FreeRADIUS 1.1.7 DoS (Intevydis)
- FreeRADIUS Homepage (FreeRADIUS)
- Version 1.1.8 has been released (FreeRadius)
- VulnDisco Pack Professional (Intevydis)