I. Description
Two vulnerabilities in various implementations of RADIUS clients and
servers have been reported to several vendors and the CERT/CC. They are
remotely exploitable, and on most systems result in a denial of service.
VU#589523 may allow the execution of code if the attacker has knowledge of
the shared secret. Certain implementations vulnerable to VU#589523 may
allow the execution of code if multiple packets are processed in the same
thread, and the last 1 or 2 bytes of the shared secret is with in a
certain range.
VU#589523 -
Multiple implementations of the RADIUS protocol contain a digest
calculation buffer overflow
Multiple implementations of the RADIUS protocol contain a
buffer overflow in the function that calculates message digests.
During the message digest calculation, a string containing the shared
secret is concatenated with a packet received without checking the size of
the target buffer. This makes it possible to overflow the buffer with
shared secret data. This can lead to a denial of service against the
server. If the shared secret is known by the attacker, then it may be
possible to use this information to execute arbitrary code with the
privileges of the victim RADIUS server or client, usually root. It should
be noted that gaining knowledge of the shared secret is not a trivial
task.
Certain implementations of RADIUS vulnerable to VU#589523 may allow the
execution of code if multiple packets are processed in the same thread,
and the last 1 or 2 bytes of the shared secret is with in a certain range.
In this case, specific knowledge of the shared secret is not required.
Systems Affected by VU#589523
- Ascend RADIUS versions 1.16 and prior
- Cistron RADIUS versions 1.6.4 and prior
- FreeRADIUS versions 0.3 and prior
- GnuRADIUS versions 0.95 and prior
- ICRADIUS versions 0.18.1 and prior
- Livingston RADIUS versions 2.1 and earlier
- Novell Border Manager
- RADIUS (commonly known as Lucent RADIUS) versions 2.1 and prior
- RADIUSClient versions 0.3.1 and prior
- Secure Computing Corp. SafeWord version 5.2 and SafeWord
PremierAccess v3.0
- Vircom VOP Radius 3.2 and prior
- XTRADIUS 1.1-pre1 and prior
- YARD RADIUS 1.0.19 and prior
VU#936683 -
Multiple implementations of the RADIUS protocol do not adequately validate
the vendor-length of vendor-specific attributes.
Various RADIUS servers and clients permit the passing of
vendor-specific and user-specific attributes. Several implementations of
RADIUS fail to check the vendor-length of vendor-specific attributes. It
is possible to cause a denial of service against RADIUS servers with a
malformed vendor-specific attribute.
RADIUS servers and clients fail to validate the vendor-length inside
vendor-specific attributes. The vendor-length shouldn't be less than 2. If
vendor-length is less than 2, the RADIUS server (or client) calculates the
attribute length as a negative number. The attribute length is then used
in various functions. In most RADIUS servers the function that performs
this calculation is rad_recv() or radrecv(). Some applications may use
the same logic to validate user-specific attributes and be vulnerable via
the same method.
Systems Affected by VU#936683
- Cistron RADIUS versions 1.6.5 and prior
- FreeRADIUS versions 0.3 and prior
- ICRADIUS versions 0.18.1 and prior
- Livingston RADIUS versions 2.1 and earlier
- Novell Border Manager
- Open System Consultants Radiator 2.6 and prior
- Secure Computing Corp. SafeWord version 5.2 and SafeWord
PremierAccess v3.0
- XTRADIUS 1.1-pre1 and prior
- YARD RADIUS 1.0.19 and prior
