Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 9 Sep 2009 13:40:09 -0400 (EDT)
From: "Steven M. Christey" <>
To: Jan Lieskovsky <>
cc: "Steven M. Christey" <>,
        oss-security <>,
        Alan T DeKok <>
Subject: Re: CVE Request -- FreeRADIUS 1.1.8

On Wed, 9 Sep 2009, Jan Lieskovsky wrote:

>    short comment yet (to be exact). This flaw was further investigated based
> on the flaws list, as mentioned in:

How do you know that the crash you found is the one that's in VulnDisco?
Maybe there are two distinct crashes.  (These types of vague disclosures
can be a real duplicate headache for us in CVE... but neither do we want
to say that a commercial 0day has been fixed when it hasn't).

CVE-2009-3111 below is anchored exclusively on the FreeRADIUS patch for
the CVE-2003-0967 regression.  If there's high confidence that this is the
same as the disclosure, then I'll integrate it into the

- Steve

Name: CVE-2009-3111
Status: Candidate
Reference: MLIST:[freeradius-users] 20090909 Version 1.1.8 has been released
Reference: URL:
Reference: MLIST:[oss-security] 20090909 CVE Request -- FreeRADIUS 1.1.8
Reference: URL:
Reference: CONFIRM:

The rad_decode function in FreeRADIUS before 1.1.8 allows remote
attackers to cause a denial of service (radiusd crash) via zero-length
Tunnel-Password attributes.  NOTE: this is a regression error related
to CVE-2003-0967.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.