Description
Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers to cause a denial of service (crash) via a Vendor-Length that is less than 2.
References
- RHSA-2002:030 vendor-advisory
- radius-vendor-attribute-dos(8354) vdb-entry
- VU#936683 third-party-advisory
- 20020305 SECURITY.NNOV: few vulnerabilities in multiple RADIUS implementations mailing-list
- SuSE-SA:2002:013 vendor-advisory
- 4230 vdb-entry
- CLA-2002:466 vendor-advisory
- CA-2002-06 third-party-advisory