oss-security - Re: CVE Request -- FreeRADIUS 1.1.8

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Wed, 9 Sep 2009 13:40:09 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: Jan Lieskovsky <jlieskov@...hat.com>
cc: "Steven M. Christey" <coley@...us.mitre.org>,
        oss-security <oss-security@...ts.openwall.com>,
        Alan T DeKok <aland@...eradius.org>
Subject: Re: CVE Request -- FreeRADIUS 1.1.8

On Wed, 9 Sep 2009, Jan Lieskovsky wrote:

>    short comment yet (to be exact). This flaw was further investigated based
> on the flaws list, as mentioned in:
>
>        http://intevydis.com/vd-list.shtml

How do you know that the crash you found is the one that's in VulnDisco?
Maybe there are two distinct crashes.  (These types of vague disclosures
can be a real duplicate headache for us in CVE... but neither do we want
to say that a commercial 0day has been fixed when it hasn't).

CVE-2009-3111 below is anchored exclusively on the FreeRADIUS patch for
the CVE-2003-0967 regression.  If there's high confidence that this is the
same as the intevydis.com disclosure, then I'll integrate it into the
description/references.

- Steve

======================================================
Name: CVE-2009-3111
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3111
Reference: MLIST:[freeradius-users] 20090909 Version 1.1.8 has been released
Reference: URL:https://lists.freeradius.org/pipermail/freeradius-users/2009-September/msg00242.html
Reference: MLIST:[oss-security] 20090909 CVE Request -- FreeRADIUS 1.1.8
Reference: URL:http://www.openwall.com/lists/oss-security/2009/09/09/1
Reference: CONFIRM:http://github.com/alandekok/freeradius-server/commit/860cad9e02ba344edb0038419e415fe05a9a01f4

The rad_decode function in FreeRADIUS before 1.1.8 allows remote
attackers to cause a denial of service (radiusd crash) via zero-length
Tunnel-Password attributes.  NOTE: this is a regression error related
to CVE-2003-0967.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.