FreeBSD : freeradius -- EAP-TTLS Tunnel Memory Leak Remote DOS Vulnerability (c110eda2-e995-11db-a944-0012f06707f0)

High Nessus Plugin ID 25051


The remote FreeBSD host is missing one or more security-related updates.


The freeradius development team reports :

A malicious 802.1x supplicant could send malformed Diameter format attributes inside of an EAP-TTLS tunnel. The server would reject the authentication request, but would leak one VALUE_PAIR data structure, of approximately 300 bytes. If an attacker performed the attack many times (e.g. thousands or more over a period of minutes to hours), the server could leak megabytes of memory, potentially leading to an 'out of memory' condition, and early process exit.


Update the affected packages.

See Also

Plugin Details

Severity: High

ID: 25051

File Name: freebsd_pkg_c110eda2e99511dba9440012f06707f0.nasl

Version: $Revision: 1.21 $

Type: local

Published: 2007/04/19

Modified: 2017/07/05

Dependencies: 12634

Risk Information

Risk Factor: High


Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:freeradius, p-cpe:/a:freebsd:freebsd:freeradius-mysql, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2007/04/13

Vulnerability Publication Date: 2007/04/10

Reference Information

CVE: CVE-2005-1454, CVE-2005-1455, CVE-2005-4745, CVE-2007-2028

BID: 23466