Memory leak in freeRADIUS 1.1.5 and earlier allows remote attackers to cause a denial of service (memory consumption) via a large number of EAP-TTLS tunnel connections using malformed Diameter format attributes, which causes the authentication request to be rejected but does not reclaim VALUE_PAIR data structures.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2007-0338 advisory.

    [1.0.1-3.RHEL4.5]
     - fixed CVE-2007-2028: EAP-TTLS denial of service        Resolves: rhbz#236247

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A memory leak flaw was found in the way FreeRADIUS parses certain authentication requests. A remote attacker could send a specially crafted authentication request which could cause FreeRADIUS to leak a small amount of memory. If enough of these requests are sent, the FreeRADIUS daemon would consume a vast quantity of system memory leading to a possible denial of service. (CVE-2007-2028)

A memory leak in the code for handling EAP-TTLS tunnels could be exploited by attackers to crash freeradius. (CVE-2007-2028)

A memory leak in the code for handling EAP-TTLS tunnels could be exploited by attackers to crash freeradius (CVE-2007-2028).

Updated freeradius packages that fix a memory leak flaw are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

FreeRADIUS is a high-performance and highly configurable free RADIUS server designed to allow centralized authentication and authorization for a network.

A memory leak flaw was found in the way FreeRADIUS parses certain authentication requests. A remote attacker could send a specially crafted authentication request which could cause FreeRADIUS to leak a small amount of memory. If enough of these requests are sent, the FreeRADIUS daemon would consume a vast quantity of system memory leading to a possible denial of service. (CVE-2007-2028)

Users of FreeRADIUS should update to these erratum packages, which contain a backported patch to correct this issue.

Memory leak in freeRADIUS 1.1.5 and earlier allows remote attackers to cause a denial of service (memory consumption) via a large number of EAP-TTLS tunnel connections using malformed Diameter format attributes, which causes the authentication request to be rejected but does not reclaim VALUE_PAIR data structures.

Updated packages have been patched to correct this issue.

The remote host is affected by the vulnerability described in GLSA-200704-14 (FreeRADIUS: Denial of Service)

    The Coverity Scan project has discovered a memory leak within the     handling of certain malformed Diameter format values inside an EAP-TTLS     tunnel.
  Impact :

    A remote attacker could send a large amount of specially crafted     packets to a FreeRADIUS server using EAP-TTLS authentication and     exhaust all memory, possibly resulting in a Denial of Service.
  Workaround :

    There is no known workaround at this time.

The freeradius development team reports :

A malicious 802.1x supplicant could send malformed Diameter format attributes inside of an EAP-TTLS tunnel. The server would reject the authentication request, but would leak one VALUE_PAIR data structure, of approximately 300 bytes. If an attacker performed the attack many times (e.g. thousands or more over a period of minutes to hours), the server could leak megabytes of memory, potentially leading to an 'out of memory' condition, and early process exit.

ID	Name	Product	Family	Severity
67489	Oracle Linux 5 : Moderate: / freeradius (ELSA-2007-0338)	Nessus	Oracle Linux Local Security Checks	high
60178	Scientific Linux Security Update : freeradius on SL3.0.x , SL4.x, SL5.x	Nessus	Scientific Linux Local Security Checks	medium
41133	SuSE9 Security Update : freeradius (YOU Patch Number 11512)	Nessus	SuSE Local Security Checks	medium
29435	SuSE 10 Security Update : freeradius (ZYPP Patch Number 3287)	Nessus	SuSE Local Security Checks	medium
27223	openSUSE 10 Security Update : freeradius (freeradius-3286)	Nessus	SuSE Local Security Checks	medium
25213	RHEL 3 / 4 / 5 : freeradius (RHSA-2007:0338)	Nessus	Red Hat Local Security Checks	medium
25204	CentOS 3 / 4 / 5 : freeradius (CESA-2007:0338)	Nessus	CentOS Local Security Checks	medium
25063	Mandrake Linux Security Advisory : freeradius (MDKSA-2007:085)	Nessus	Mandriva Local Security Checks	medium
25059	GLSA-200704-14 : FreeRADIUS: Denial of Service	Nessus	Gentoo Local Security Checks	medium
25051	FreeBSD : freeradius -- EAP-TTLS Tunnel Memory Leak Remote DOS Vulnerability (c110eda2-e995-11db-a944-0012f06707f0)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2007-2028

high

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

high