CVE Vulnerability

CVE-2007-2028

Memory leak in freeRADIUS 1.1.5 and earlier allows remote attackers to cause a denial of service (memory consumption) via a large number of EAP-TTLS tunnel connections using malformed Diameter format attributes, which causes the authentication request to be rejected but does not reclaim VALUE_PAIR data structures.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

Scope

References
Link Resource
http://www.freeradius.org/security.html
http://www.securityfocus.com/bid/23466
http://secunia.com/advisories/24849
http://secunia.com/advisories/24907
http://security.gentoo.org/glsa/glsa-200704-14.xml
http://www.trustix.org/errata/2007/0013/
http://secunia.com/advisories/24917
http://secunia.com/advisories/24996
http://rhn.redhat.com/errata/RHSA-2007-0338.html
http://www.novell.com/linux/security/advisories/2007_10_sr.html
http://www.securitytracker.com/id?1018042
http://secunia.com/advisories/25201
http://secunia.com/advisories/25220
http://www.mandriva.com/security/advisories?name=MDKSA-2007:085
http://www.vupen.com/english/advisories/2007/1369
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11156
Configurations

Configuration 1

cpe:2.3:a:freeradius:freeradius:*:*:*:*:*:*:*:*
Information

Published : 2007-04-13 06:19

Updated : 2017-10-11 01:32

NVD link : CVE-2007-2028

Mitre link : CVE-2007-2028

Products Affected
No products.
CWE
NVD-CWE-Other