CVE-2001-1377 Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers to cause a denial of service (crash) via a Vendor-Length that...
MediumCVSS 5.0
EPSS 5.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers to cause a denial of service (crash) via a Vendor-Length that is less than 2.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| freeradius | = 0.2 | No fix listed |
| freeradius | = 0.3 | No fix listed |
| GNU radius | = 0.92.1 | No fix listed |
| GNU radius | = 0.93 | No fix listed |
| GNU radius | = 0.94 | No fix listed |
| GNU radius | = 0.95 | No fix listed |
| icradius | = 0.14 | No fix listed |
| icradius | = 0.15 | No fix listed |
| icradius | = 0.16 | No fix listed |
| icradius | = 0.17 | No fix listed |
| icradius | = 0.17b | No fix listed |
| icradius | = 0.18 | No fix listed |
| icradius | = 0.18.1 | No fix listed |
| livingston radius | = 2.0 | No fix listed |
| livingston radius | = 2.0.1 | No fix listed |
| livingston radius | = 2.1 | No fix listed |
| lucent radius | = 2.0 | No fix listed |
| lucent radius | = 2.0.1 | No fix listed |
| lucent radius | = 2.1 | No fix listed |
| miquel van smoorenburg cistron radius | = 1.6.1 | No fix listed |
| miquel van smoorenburg cistron radius | = 1.6.2 | No fix listed |
| miquel van smoorenburg cistron radius | = 1.6.3 | No fix listed |
| miquel van smoorenburg cistron radius | = 1.6.4 | No fix listed |
| miquel van smoorenburg cistron radius | = 1.6.5 | No fix listed |
| miquel van smoorenburg cistron radius | = 1.6_.0 | No fix listed |
Show 15 more
| Product | Affected versions | Fixed in |
|---|---|---|
| openradius | = 0.8 | No fix listed |
| openradius | = 0.9 | No fix listed |
| openradius | = 0.9.1 | No fix listed |
| openradius | = 0.9.2 | No fix listed |
| openradius | = 0.9.3 | No fix listed |
| radiusclient | = 0.3.1 | No fix listed |
| xtradius | = 1.1_pre1 | No fix listed |
| xtradius | = 1.1_pre2 | No fix listed |
| yard radius | = 1.0.17 | No fix listed |
| yard radius | = 1.0.18 | No fix listed |
| yard radius | = 1.0.19 | No fix listed |
| yard radius | = 1.0_pre13 | No fix listed |
| yard radius | = 1.0_pre14 | No fix listed |
| yard radius | = 1.0_pre15 | No fix listed |
| yard radius project yard radius | = 1.0.16 | No fix listed |
References
- SuSE-SA:2002:013 vendor-advisory
- CLA-2002:466 vendor-advisory
- 20020305 SECURITY.NNOV: few vulnerabilities in multiple RADIUS implementations mailing-list
- CA-2002-06 patch third-party-advisory us-government-resource
- radius-vendor-attribute-dos(8354) patch vdb-entry vendor-advisory
- VU#936683 patch third-party-advisory us-government-resource
- RHSA-2002:030 vendor-advisory
- 4230 patch vdb-entry vendor-advisory