FreeRADIUS: heap exploit and NULL pointer dereference vulnerability

1. Gentoo Linux Security Advisory

Advisory Reference	GLSA 200311-04 / FreeRADIUS
Release Date	November 23, 2003
Latest Revision	November 23, 2003: 01
Impact	normal
Exploitable	remote

Package	Vulnerable versions	Unaffected versions	Architecture(s)
net-dialup/freeradius	<= 0.9.2	>= 0.9.3	All supported architectures

Related bugreports: #33989

Synopsis

FreeRADIUS is vulnerable to a heap exploit and a NULL pointer dereference vulnerability.

2. Impact Information

Background

FreeRADIUS is a popular open source RADIUS server.

Description

FreeRADIUS versions below 0.9.3 are vulnerable to a heap exploit, however, the attack code must be in the form of a valid RADIUS packet which limits the possible exploits.

Also corrected in the 0.9.3 release is another vulnerability which causes the RADIUS server to de-reference a NULL pointer and crash when an Access-Request packet with a Tunnel-Password is received.

Impact

A remote attacker could craft a RADIUS packet which would cause the RADIUS server to crash, or could possibly overflow the heap resulting in a system compromise.

3. Resolution Information

Workaround

There is no known workaround at this time.

Resolution

Users are encouraged to perform an 'emerge sync' and upgrade the package to the latest available version - 0.9.3 is available in portage and is marked as stable.

Code Listing 3.1: Resolution

# emerge sync
# emerge -pv '>=net-dialup/freeradius-0.9.3'
# emerge '>=net-dialup/freeradius-0.9.3'
# emerge clean

4. References

SecurityTracker.com Security Alert

Page updated November 23, 2003

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.