CVE-2003-0967 - Vulnerability Details - OpenCVE

rad_decode in FreeRADIUS 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a short RADIUS string attribute with a tag, which causes memcpy to be called with a -1 length argument, as demonstrated using the Tunnel-Password attribute.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Freeradius	Freeradius
Redhat	Enterprise Linux

Configuration 1 [-]

cpe:2.3:a:freeradius:freeradius:*:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 3
freeradius-0:0.9.3-1	cpe:/o:redhat:enterprise_linux:3	RHSA-2003:386	2003-12-10T00:00:00Z

References

Link	Providers
http://marc.info/?l=bugtraq&m=106935911101493&w=2
http://marc.info/?l=bugtraq&m=106944220426970
http://marc.info/?l=freeradius-users&m=106947389449613&w=2
http://www.redhat.com/support/errata/RHSA-2003-386.html
https://nvd.nist.gov/vuln/detail/CVE-2003-0967
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10917
https://www.cve.org/CVERecord?id=CVE-2003-0967

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2003-12-02T05:00:00

Updated: 2024-08-08T02:12:34.859Z

Reserved: 2003-11-26T00:00:00

Link: CVE-2003-0967

Vulnrichment

No data.

NVD

Status : Modified

Published: 2003-12-15T05:00:00.000

Modified: 2024-11-20T23:45:58.587

Link: CVE-2003-0967

Redhat

Severity : Moderate

Publid Date: 2003-11-20T00:00:00Z

Links: CVE-2003-0967 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2003-11-21T00:00:00", "descriptions": [{"lang": "en", "value": "rad_decode in FreeRADIUS 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a short RADIUS string attribute with a tag, which causes memcpy to be called with a -1 length argument, as demonstrated using the Tunnel-Password attribute."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-10-10T00:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "20031120 Remote DoS in FreeRADIUS, all versions.", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://marc.info/?l=bugtraq&m=106935911101493&w=2"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://marc.info/?l=freeradius-users&m=106947389449613&w=2"}, {"name": "RHSA-2003:386", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://www.redhat.com/support/errata/RHSA-2003-386.html"}, {"name": "oval:org.mitre.oval:def:10917", "tags": ["vdb-entry", "signature", "x_refsource_OVAL"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10917"}, {"name": "20031121 FreeRADIUS 0.9.2 \"Tunnel-Password\" attribute Handling Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://marc.info/?l=bugtraq&m=106944220426970"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2003-0967", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "rad_decode in FreeRADIUS 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a short RADIUS string attribute with a tag, which causes memcpy to be called with a -1 length argument, as demonstrated using the Tunnel-Password attribute."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20031120 Remote DoS in FreeRADIUS, all versions.", "refsource": "BUGTRAQ", "url": "http://marc.info/?l=bugtraq&m=106935911101493&w=2"}, {"name": "http://marc.info/?l=freeradius-users&m=106947389449613&w=2", "refsource": "CONFIRM", "url": "http://marc.info/?l=freeradius-users&m=106947389449613&w=2"}, {"name": "RHSA-2003:386", "refsource": "REDHAT", "url": "http://www.redhat.com/support/errata/RHSA-2003-386.html"}, {"name": "oval:org.mitre.oval:def:10917", "refsource": "OVAL", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10917"}, {"name": "20031121 FreeRADIUS 0.9.2 \"Tunnel-Password\" attribute Handling Vulnerability", "refsource": "BUGTRAQ", "url": "http://marc.info/?l=bugtraq&m=106944220426970"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-08T02:12:34.859Z"}, "title": "CVE Program Container", "references": [{"name": "20031120 Remote DoS in FreeRADIUS, all versions.", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=106935911101493&w=2"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://marc.info/?l=freeradius-users&m=106947389449613&w=2"}, {"name": "RHSA-2003:386", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://www.redhat.com/support/errata/RHSA-2003-386.html"}, {"name": "oval:org.mitre.oval:def:10917", "tags": ["vdb-entry", "signature", "x_refsource_OVAL", "x_transferred"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10917"}, {"name": "20031121 FreeRADIUS 0.9.2 \"Tunnel-Password\" attribute Handling Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=106944220426970"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2003-0967", "datePublished": "2003-12-02T05:00:00", "dateReserved": "2003-11-26T00:00:00", "dateUpdated": "2024-08-08T02:12:34.859Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:freeradius:freeradius:*:*:*:*:*:*:*:*", "matchCriteriaId": "9F80EF7F-BDC2-4D5E-B878-3F0BA3959485", "versionEndIncluding": "0.9.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "rad_decode in FreeRADIUS 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a short RADIUS string attribute with a tag, which causes memcpy to be called with a -1 length argument, as demonstrated using the Tunnel-Password attribute."}, {"lang": "es", "value": "rad_decode en FreeRADIUS 0.9.2 y anteriores permite a atacantes remotos causar una denegaci\u00f3n de servicio (ca\u00edda) mediante una cadena de atributo RADIUS corta con una etiqueta, lo que hace se llame a memcpy con un argumento de longitud -1, como se ha demostrado usando el atributo \"Tunnel-Password\"."}], "id": "CVE-2003-0967", "lastModified": "2024-11-20T23:45:58.587", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2003-12-15T05:00:00.000", "references": [{"source": "cve@mitre.org", "url": "http://marc.info/?l=bugtraq&m=106935911101493&w=2"}, {"source": "cve@mitre.org", "url": "http://marc.info/?l=bugtraq&m=106944220426970"}, {"source": "cve@mitre.org", "url": "http://marc.info/?l=freeradius-users&m=106947389449613&w=2"}, {"source": "cve@mitre.org", "url": "http://www.redhat.com/support/errata/RHSA-2003-386.html"}, {"source": "cve@mitre.org", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10917"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://marc.info/?l=bugtraq&m=106935911101493&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://marc.info/?l=bugtraq&m=106944220426970"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://marc.info/?l=freeradius-users&m=106947389449613&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.redhat.com/support/errata/RHSA-2003-386.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10917"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}