medium5.0

CVE-2001-1377

Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers to cause a denial of…

Impact

Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers to cause a denial of service (crash) via a Vendor-Length that is less than 2.

Affected products

Vendor	Product	Affected versions
Freeradius	Freeradius	Versions 0.2, 0.3
Gnu	Radius	Versions 0.92.1, 0.93, 0.94, 0.95
Icradius	Icradius	Versions 0.14, 0.15, 0.16, 0.17, 0.17b, 0.18
Livingston	Radius	Versions 2.0, 2.0.1, 2.1
Lucent	Radius	Versions 2.0, 2.0.1, 2.1
Miquel Van Smoorenburg Cistron	Radius	Versions 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.6.5, 1.6_.0
Openradius	Openradius	Versions 0.8, 0.9, 0.9.1, 0.9.2, 0.9.3
Radiusclient	Radiusclient	Version 0.3.1
Xtradius	Xtradius	Versions 1.1_pre1, 1.1_pre2
Yard Radius	Yard Radius	Versions 1.0.17, 1.0.18, 1.0.19, 1.0_pre13, 1.0_pre14, 1.0_pre15
Yard Radius Project	Yard Radius	Version 1.0.16

Impact

Affected products

References