FreeRADIUS CVE-2017-10984 Out-Of-Bounds Write Remote Code Execution Vulnerability

Bugtraq ID:	99876
Class:	Input Validation Error
CVE:	CVE-2017-10984
Remote:	Yes
Local:	No
Published:	Jul 17 2017 12:00AM
Updated:	Jul 31 2017 10:08AM
Credit:	FreeRADIUS project
Vulnerable:	Ubuntu Ubuntu Linux 17.04 Ubuntu Ubuntu Linux 16.04 LTS Ubuntu Ubuntu Linux 14.04 LTS Redhat Enterprise Linux 7 FreeRADIUS FreeRADIUS 3.0.14 FreeRADIUS FreeRADIUS 3.0.13 FreeRADIUS FreeRADIUS 3.0.12 FreeRADIUS FreeRADIUS 3.0.11 FreeRADIUS FreeRADIUS 3.0.10 FreeRADIUS FreeRADIUS 3.0.7 FreeRADIUS FreeRADIUS 3.0.6 FreeRADIUS FreeRADIUS 3.0.5 FreeRADIUS FreeRADIUS 3.0.4 FreeRADIUS FreeRADIUS 3.0.3 FreeRADIUS FreeRADIUS 3.0.2 FreeRADIUS FreeRADIUS 3.0.1 FreeRADIUS FreeRADIUS 3.0.9 FreeRADIUS FreeRADIUS 3.0.8
Not Vulnerable:	FreeRADIUS FreeRADIUS 3.0.15

FreeRADIUS CVE-2017-10984 Out-Of-Bounds Write Remote Code Execution Vulnerability

FreeRADIUS is prone to an remote code-execution vulnerability.

An attacker could exploit this issue to crash the server or to execute arbitrary code within the context of the server process.

FreeRADIUS 3.0.0 through 3.0.14 are vulnerable.

FreeRADIUS CVE-2017-10984 Out-Of-Bounds Write Remote Code Execution Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

FreeRADIUS CVE-2017-10984 Out-Of-Bounds Write Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

FreeRADIUS CVE-2017-10984 Out-Of-Bounds Write Remote Code Execution Vulnerability

References:

• FreeRADIUS Homepage (FreeRADIUS)
  
• Bug 1468549 - CVE-2017-10984 freeradius: Out-of-bounds write in data2vp_wimax() (Redhat)
  
• CVE-2017-10984 (Redhat)