CVE-2009-3111
09.09.2009, 18:30
The rad_decode function in FreeRADIUS before 1.1.8 allows remote attackers to cause a denial of service (radiusd crash) via zero-length Tunnel-Password attributes, as demonstrated by a certain module in VulnDisco Pack Professional 7.6 through 8.11. NOTE: this is a regression error related to CVE-2003-0967.Enginsight
| Vendor | Product | Version |
|---|---|---|
| freeradius | freeradius | 𝑥 ≤ 1.1.7 |
| freeradius | freeradius | 0.2 |
| freeradius | freeradius | 0.3 |
| freeradius | freeradius | 0.4 |
| freeradius | freeradius | 0.5 |
| freeradius | freeradius | 0.8 |
| freeradius | freeradius | 0.8.1 |
| freeradius | freeradius | 0.9 |
| freeradius | freeradius | 0.9.1 |
| freeradius | freeradius | 0.9.2 |
| freeradius | freeradius | 0.9.3 |
| freeradius | freeradius | 1.0.0 |
| freeradius | freeradius | 1.0.1 |
| freeradius | freeradius | 1.0.2 |
| freeradius | freeradius | 1.0.3 |
| freeradius | freeradius | 1.0.4 |
| freeradius | freeradius | 1.0.5 |
| freeradius | freeradius | 1.1.0 |
| freeradius | freeradius | 1.1.3 |
| freeradius | freeradius | 1.1.5 |
| freeradius | freeradius | 1.1.6 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
References