CVE-2017-10978
HighSummary
An FR-GV-201 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows 'Read / write overflow in make_secret()' and a denial of service.
Risk Assessment
This vulnerability may lead to server crashes, affecting the availability of authentication services within the organization.
Recommendation
It is recommended to upgrade FreeRADIUS to version 2.2.10 or 3.0.15 to mitigate this vulnerability.
Other vulnerabilities in FreeRADIUS
See all- CVE-2017-10981High
FreeRADIUS 2.x versions before 2.2.10 have a memory leak issue in the fr_dhcp_decode() function, leading to a denial of service.
- CVE-2017-10980High
FreeRADIUS 2.x versions before 2.2.10 have an FR-GV-203 issue that leads to a memory leak in the decode_tlv() function and can cause denial of service.
- CVE-2015-4680High
FreeRADIUS versions 2.2.x before 2.2.8 and 3.0.x before 3.0.9 do not properly check revocation of intermediate CA certificates.
- CVE-2017-9148Critical
The TLS session cache in FreeRADIUS from versions 2.1.1 to 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 has a problem with reliably preventing the resumption of an unauthenticated session. This allows remote attackers, such as malicious 802.1X supplicants, to bypass authentication via PEAP or TTLS.
Original NVD description (English source)
An FR-GV-201 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "Read / write overflow in make_secret()" and a denial of service.