SB2017032707 - Multiple vulnerabilities in FreeRADIUS

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) NULL pointer dereference (CVE-ID: CVE-2015-8762)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via a zero-length EAP-PWD packet.

2) Out-of-bounds read (CVE-ID: CVE-2015-8763)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to have unspecified impact via a crafted (1) commit or (2) confirm message, which triggers an out-of-bounds read.

3) Buffer overflow (CVE-ID: CVE-2015-8764)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Off-by-one error in the EAP-PWD module in FreeRADIUS 3.0 through 3.0.8, which triggers a buffer overflow.

Remediation

Install update from vendor's website.

References

• http://freeradius.org/security.html#eap-pwd-2015
• http://www.openwall.com/lists/oss-security/2016/01/08/7