Actu
Vigil@nce - FreeRADIUS: denials of service
October 2010 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/
SYNTHESIS OF THE VULNERABILITY
An attacker can use two denials of service, in order to stop
FreeRADIUS.
Severity: 2/4
Creation date: 04/10/2010
DESCRIPTION OF THE VULNERABILITY
Two vulnerabilities were announced in FreeRADIUS.
An attacker can send several queries, in order to slow the query
processing. After thirty seconds of inactivity, a query is
canceled, however as its memory area is still used, the memory is
corrupted. [severity:2/4; CVE-2010-3697]
An attacker can send a DHCP packet containing several options, in
order to generate an infinite loop. [severity:2/4; CVE-2010-3696]
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/FreeRADIUS-denials-of-service-9996
