Unscored severity · published Mar 4, 2002
CVE-2001-1377
Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers to cause a denial of service (crash) via…
–
CVSS
5.4%
EPSS
No
On KEV
Description
Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers to cause a denial of service (crash) via a Vendor-Length that is less than 2.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.4% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
Freeradius · Freeradius
0.2; 0.3 · source: NVD
IC
Icradius · Icradius
0.14; 0.15; 0.16; 0.17; 0.17b; 0.18; +1 more · source: NVD
OP
Openradius · Openradius
0.8; 0.9; 0.9.1; 0.9.2; 0.9.3 · source: NVD
RA
Radius · Lucent
2.0; 2.0.1; 2.1 · source: NVD
RA
Radiusclient · Radiusclient
0.3.1 · source: NVD
XT
Xtradius · Xtradius
1.1_pre1; 1.1_pre2 · source: NVD
YR
Yard Radius · Yard Radius
1.0.17; 1.0.18; 1.0.19; 1.0_pre13; 1.0_pre14; 1.0_pre15 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2001-1377
CVE.org
https://www.cve.org/CVERecord?id=CVE-2001-1377
archives.neohapsis.com
http://archives.neohapsis.com/archives/linux/suse/2002-q2/0362.html
distro.conectiva.com.br
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000466
marc.info
http://marc.info/?l=bugtraq&m=101537153021792&w=2
Patch
http://www.cert.org/advisories/CA-2002-06.html
Patch
http://www.iss.net/security_center/static/8354.php
More from Freeradius
9.8
CVE-2019-11235
FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve…
9.8
CVE-2019-11234
FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497
9.8
CVE-2017-10984
An FR-GV-301 issue in FreeRADIUS 3.x before 3.0.15 allows "Write overflow in data2vp_wimax()" - this allows remote attackers to cause a denial of service (daemon crash) or…
9.8
CVE-2017-10979
An FR-GV-202 issue in FreeRADIUS 2.x before 2.2.10 allows "Write overflow in rad_coalesce()" - this allows remote attackers to cause a denial of service (daemon crash) or possibly…
9.8
CVE-2017-9148
The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an…