Summary
Guido Vranken discovered that FreeRADIUS incorrectly handled memory when
decoding packets. A remote attacker could use this issue to cause
FreeRADIUS to crash or hang, resulting in a denial of service, or possibly
execute arbitrary code.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | freeradius | 2.1.12+dfsg-1.2ubuntu8.2 |
| Ubuntu · 16.04 LTS 16.04:LTS | freeradius | 2.2.8+dfsg-0.1ubuntu0.1 |
Vulnerabilities 6
-
Unscored —
An FR-GV-201 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "Read / write overflow in make_secret()…
-
Unscored —
An FR-GV-202 issue in FreeRADIUS 2.x before 2.2.10 allows "Write overflow in rad_coalesce()" - this allows remote attac…
-
Unscored —
An FR-GV-203 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Memory leak in decode_tlv()" and a denial of service.
-
Unscored —
An FR-GV-204 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Memory leak in fr_dhcp_decode()" and a denial of serv…
-
Unscored —
An FR-GV-205 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Buffer over-read in fr_dhcp_decode_options()" and a d…
-
Unscored —
An FR-GV-206 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "DHCP - Read overflow when decoding opt…
References
-
report
https://ubuntu.com/security/CVE-2017-10978
-
report
https://ubuntu.com/security/CVE-2017-10979
-
report
https://ubuntu.com/security/CVE-2017-10980
-
report
https://ubuntu.com/security/CVE-2017-10981
-
report
https://ubuntu.com/security/CVE-2017-10982
-
report
https://ubuntu.com/security/CVE-2017-10983
-
report
https://ubuntu.com/security/CVE-2017-10984
-
report
https://ubuntu.com/security/CVE-2017-10985
-
report
https://ubuntu.com/security/CVE-2017-10986
-
report
https://ubuntu.com/security/CVE-2017-10987