Out-of-bounds read in FreeRADIUS - CVE-2017-10982
Published: July 18, 2017
Vulnerability identifier: #VU7556
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-10982
CWE-ID: CWE-125
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak in fr_dhcp_decode_options() function when processing DHCP packets. A remote attacker on local network can send specially crafted DHCP packets with malicious options to vulnerable system and trigger denial of service attack.
Affected software
FreeRADIUS
Debian Linux
Amazon Linux AMI
Red Hat Enterprise Linux for x86_64
Ubuntu
Debian Linux
Amazon Linux AMI
Red Hat Enterprise Linux for x86_64
Ubuntu
How to mitigate CVE-2017-10982
Update to version 2.2.10.