Memory leak in FreeRADIUS - CVE-2017-10981
Published: July 18, 2017
Vulnerability identifier: #VU7555
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-10981
CWE-ID: CWE-401
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak in fr_dhcp_decode() function when processing DHCP packets. A remote attacker on local network can send specially crafted DHCP packets with malicious options to vulnerable system and trigger denial of service attack.
Affected software
FreeRADIUS
Debian Linux
Amazon Linux AMI
Red Hat Enterprise Linux for x86_64
Ubuntu
Debian Linux
Amazon Linux AMI
Red Hat Enterprise Linux for x86_64
Ubuntu
How to mitigate CVE-2017-10981
Update to version 2.2.10.