Lucene search
HistoryNov 29, 2008 - 2:30 a.m.
CVE-2008-5284
iea software
radiusnt
radiusx
emerald
air marshal
radlogin
denial of service
remote attack
memory overwrite
http
vulnerability
10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
6.7 Medium
AI Score
Confidence
High
0.084 Low
EPSS
Percentile
94.4%
The web server in IEA Software RadiusNT and RadiusX 5.1.38 and other versions before 5.1.44, Emerald 5.0.49 and other versions before 5.0.52, Air Marshal 2.0.4 and other versions before 2.0.8, and Radius test client (aka Radlogin) 4.0.20 and earlier, allows remote attackers to cause a denial of service (crash) via an HTTP Content-Length header with a negative value, which triggers a single byte overwrite of memory using a NULL terminator. NOTE: some of these details are obtained from third party information.
Affected configurations
Node
iea_softwareair_marshalMatch1.0.3
ORiea_softwareair_marshalMatch1.0.4
ORiea_softwareair_marshalMatch1.0.5
ORiea_softwareair_marshalMatch1.0.6
ORiea_softwareair_marshalMatch1.0.7
ORiea_softwareair_marshalMatch1.0.8
ORiea_softwareair_marshalMatch1.0.9
ORiea_softwareair_marshalMatch1.0.10
ORiea_softwareair_marshalMatch1.0.11
ORiea_softwareair_marshalMatch1.0.15
ORiea_softwareair_marshalMatch1.0.16
ORiea_softwareair_marshalMatch1.0.18
ORiea_softwareair_marshalMatch1.0.19
ORiea_softwareair_marshalMatch1.0.20
ORiea_softwareair_marshalMatch1.0.21
ORiea_softwareair_marshalMatch1.0.22
ORiea_softwareair_marshalMatch2.0.0
ORiea_softwareair_marshalMatch2.0.0.b.7
ORiea_softwareair_marshalMatch2.0.0.b1
ORiea_softwareair_marshalMatch2.0.1
ORiea_softwareair_marshalMatch2.0.3
ORiea_softwareair_marshalMatch2.0.4
ORiea_softwareair_marshalMatch2.0.5
ORiea_softwareemeraldMatch5.0.24
ORiea_softwareemeraldMatch5.0.25
ORiea_softwareemeraldMatch5.0.26
ORiea_softwareemeraldMatch5.0.27
ORiea_softwareemeraldMatch5.0.28
ORiea_softwareemeraldMatch5.0.29
ORiea_softwareemeraldMatch5.0.30
ORiea_softwareemeraldMatch5.0.31
ORiea_softwareemeraldMatch5.0.32
ORiea_softwareemeraldMatch5.0.33
ORiea_softwareemeraldMatch5.0.35
ORiea_softwareemeraldMatch5.0.36
ORiea_softwareemeraldMatch5.0.37
ORiea_softwareemeraldMatch5.0.39
ORiea_softwareemeraldMatch5.0.40
ORiea_softwareemeraldMatch5.0.41
ORiea_softwareemeraldMatch5.0.42
ORiea_softwareemeraldMatch5.0.44
ORiea_softwareemeraldMatch5.0.46
ORiea_softwareemeraldMatch5.0.48
ORiea_softwareemeraldMatch5.0.49
ORiea_softwareemeraldMatch5.0.50
ORiea_softwareemeraldMatch5.0.51
ORiea_softwareradius_test_clientMatch4.0.15
ORiea_softwareradius_test_clientMatch4.0.20
ORiea_softwareradiusntRange≤5.1.42
ORiea_softwareradiusntMatch3.0.145
ORiea_softwareradiusntMatch3.0.147
ORiea_softwareradiusntMatch3.0.149
ORiea_softwareradiusntMatch3.0.150
ORiea_softwareradiusntMatch3.0.154
ORiea_softwareradiusntMatch3.0.158
ORiea_softwareradiusntMatch3.0.162
ORiea_softwareradiusntMatch3.0.167
ORiea_softwareradiusntMatch3.0.168
ORiea_softwareradiusntMatch3.0.171
ORiea_softwareradiusntMatch3.0.172
ORiea_softwareradiusntMatch3.0.173
ORiea_softwareradiusntMatch3.0.174
ORiea_softwareradiusntMatch3.0.175
ORiea_softwareradiusntMatch3.0.176
ORiea_softwareradiusntMatch3.0.177
ORiea_softwareradiusntMatch3.0.178
ORiea_softwareradiusntMatch3.0.179
ORiea_softwareradiusntMatch3.0.182
ORiea_softwareradiusntMatch3.0.183
ORiea_softwareradiusntMatch3.0.184
ORiea_softwareradiusntMatch3.0.185
ORiea_softwareradiusntMatch3.0.186
ORiea_softwareradiusntMatch3.0.188
ORiea_softwareradiusntMatch3.0.189
ORiea_softwareradiusntMatch3.0.190
ORiea_softwareradiusntMatch3.0.191
ORiea_softwareradiusntMatch4.0.1
ORiea_softwareradiusntMatch4.0.2
ORiea_softwareradiusntMatch4.0.3
ORiea_softwareradiusntMatch4.0.5
ORiea_softwareradiusntMatch4.0.6
ORiea_softwareradiusntMatch4.0.7
ORiea_softwareradiusntMatch4.0.8
ORiea_softwareradiusntMatch4.0.10
ORiea_softwareradiusntMatch4.0.11
ORiea_softwareradiusntMatch4.0.12
ORiea_softwareradiusntMatch4.0.13
ORiea_softwareradiusntMatch4.0.14
ORiea_softwareradiusntMatch4.0.15
ORiea_softwareradiusntMatch4.0.17
ORiea_softwareradiusntMatch4.0.20
ORiea_softwareradiusntMatch4.0.21
ORiea_softwareradiusntMatch4.0.23
ORiea_softwareradiusntMatch4.0.24
ORiea_softwareradiusntMatch4.0.26
ORiea_softwareradiusntMatch4.0.27
ORiea_softwareradiusntMatch4.0.28
ORiea_softwareradiusntMatch4.0.29
ORiea_softwareradiusntMatch4.0.30
ORiea_softwareradiusntMatch4.0.31
ORiea_softwareradiusntMatch4.0.32
ORiea_softwareradiusntMatch4.0.33
ORiea_softwareradiusntMatch4.0.34
ORiea_softwareradiusntMatch4.0.35
ORiea_softwareradiusntMatch4.0.38
ORiea_softwareradiusntMatch4.0.39
ORiea_softwareradiusntMatch4.0.40
ORiea_softwareradiusntMatch4.0.41
ORiea_softwareradiusntMatch4.0.43
ORiea_softwareradiusntMatch4.0.44
ORiea_softwareradiusntMatch4.0.47
ORiea_softwareradiusntMatch4.0.49
ORiea_softwareradiusntMatch4.0.51
ORiea_softwareradiusntMatch4.0.54
ORiea_softwareradiusntMatch4.0.55
ORiea_softwareradiusntMatch4.0.56
ORiea_softwareradiusntMatch4.0.57
ORiea_softwareradiusntMatch4.0.59
ORiea_softwareradiusntMatch4.0.60
ORiea_softwareradiusntMatch4.0.62
ORiea_softwareradiusntMatch4.0.63
ORiea_softwareradiusntMatch4.0.67
ORiea_softwareradiusntMatch4.0.68
ORiea_softwareradiusntMatch4.0.69
ORiea_softwareradiusntMatch4.0.70
ORiea_softwareradiusntMatch4.0.71
ORiea_softwareradiusntMatch4.0.72
ORiea_softwareradiusntMatch4.0.73
ORiea_softwareradiusntMatch4.0.74
ORiea_softwareradiusntMatch4.0.75
ORiea_softwareradiusntMatch4.0.76
ORiea_softwareradiusntMatch4.0.77
ORiea_softwareradiusntMatch4.0.79
ORiea_softwareradiusntMatch4.0.80
ORiea_softwareradiusntMatch4.0.81
ORiea_softwareradiusntMatch4.0.82
ORiea_softwareradiusntMatch4.0.83
ORiea_softwareradiusntMatch4.0.84
ORiea_softwareradiusntMatch4.0.85
ORiea_softwareradiusntMatch4.0.86
ORiea_softwareradiusntMatch4.0.193
ORiea_softwareradiusntMatch4.09
ORiea_softwareradiusntMatch5.0.4a
ORiea_softwareradiusntMatch5.0.7a
ORiea_softwareradiusntMatch5.0.8b
ORiea_softwareradiusntMatch5.0.9b
ORiea_softwareradiusntMatch5.0.10b
ORiea_softwareradiusntMatch5.0.13b
ORiea_softwareradiusntMatch5.0.15b
ORiea_softwareradiusntMatch5.0.17
ORiea_softwareradiusntMatch5.0.22
ORiea_softwareradiusntMatch5.0.27
ORiea_softwareradiusntMatch5.0.29
ORiea_softwareradiusntMatch5.0.31
ORiea_softwareradiusntMatch5.0.35
ORiea_softwareradiusntMatch5.0.36
ORiea_softwareradiusntMatch5.0.38
ORiea_softwareradiusntMatch5.0.39
ORiea_softwareradiusntMatch5.0.42
ORiea_softwareradiusntMatch5.0.43
ORiea_softwareradiusntMatch5.0.45
ORiea_softwareradiusntMatch5.0.49
ORiea_softwareradiusntMatch5.0.50
ORiea_softwareradiusntMatch5.0.54
ORiea_softwareradiusntMatch5.0.55
ORiea_softwareradiusntMatch5.0.58
ORiea_softwareradiusntMatch5.1.3
ORiea_softwareradiusntMatch5.1.4
ORiea_softwareradiusntMatch5.1.5
ORiea_softwareradiusntMatch5.1.6
ORiea_softwareradiusntMatch5.1.10
ORiea_softwareradiusntMatch5.1.15
ORiea_softwareradiusntMatch5.1.16
ORiea_softwareradiusntMatch5.1.17
ORiea_softwareradiusntMatch5.1.19
ORiea_softwareradiusntMatch5.1.24
ORiea_softwareradiusntMatch5.1.25
ORiea_softwareradiusntMatch5.1.29
ORiea_softwareradiusntMatch5.1.35
ORiea_softwareradiusntMatch5.1.38
ORiea_softwareradiusntMatch5.1.40
ORiea_softwareradiusntMatch5.1.41
ORiea_softwareradiusxRange≤5.1.42
ORiea_softwareradiusxMatch3.0.145
ORiea_softwareradiusxMatch3.0.147
ORiea_softwareradiusxMatch3.0.149
ORiea_softwareradiusxMatch3.0.150
ORiea_softwareradiusxMatch3.0.154
ORiea_softwareradiusxMatch3.0.158
ORiea_softwareradiusxMatch3.0.162
ORiea_softwareradiusxMatch3.0.167
ORiea_softwareradiusxMatch3.0.168
ORiea_softwareradiusxMatch3.0.171
ORiea_softwareradiusxMatch3.0.172
ORiea_softwareradiusxMatch3.0.173
ORiea_softwareradiusxMatch3.0.174
ORiea_softwareradiusxMatch3.0.175
ORiea_softwareradiusxMatch3.0.176
ORiea_softwareradiusxMatch3.0.177
ORiea_softwareradiusxMatch3.0.178
ORiea_softwareradiusxMatch3.0.179
ORiea_softwareradiusxMatch3.0.182
ORiea_softwareradiusxMatch3.0.183
ORiea_softwareradiusxMatch3.0.184
ORiea_softwareradiusxMatch3.0.185
ORiea_softwareradiusxMatch3.0.186
ORiea_softwareradiusxMatch3.0.188
ORiea_softwareradiusxMatch3.0.189
ORiea_softwareradiusxMatch3.0.190
ORiea_softwareradiusxMatch3.0.191
ORiea_softwareradiusxMatch4.0.1
ORiea_softwareradiusxMatch4.0.2
ORiea_softwareradiusxMatch4.0.3
ORiea_softwareradiusxMatch4.0.5
ORiea_softwareradiusxMatch4.0.6
ORiea_softwareradiusxMatch4.0.7
ORiea_softwareradiusxMatch4.0.8
ORiea_softwareradiusxMatch4.0.9
ORiea_softwareradiusxMatch4.0.10
ORiea_softwareradiusxMatch4.0.11
ORiea_softwareradiusxMatch4.0.12
ORiea_softwareradiusxMatch4.0.13
ORiea_softwareradiusxMatch4.0.14
ORiea_softwareradiusxMatch4.0.15
ORiea_softwareradiusxMatch4.0.17
ORiea_softwareradiusxMatch4.0.20
ORiea_softwareradiusxMatch4.0.21
ORiea_softwareradiusxMatch4.0.23
ORiea_softwareradiusxMatch4.0.24
ORiea_softwareradiusxMatch4.0.26
ORiea_softwareradiusxMatch4.0.27
ORiea_softwareradiusxMatch4.0.28
ORiea_softwareradiusxMatch4.0.29
ORiea_softwareradiusxMatch4.0.30
ORiea_softwareradiusxMatch4.0.31
ORiea_softwareradiusxMatch4.0.32
ORiea_softwareradiusxMatch4.0.33
ORiea_softwareradiusxMatch4.0.34
ORiea_softwareradiusxMatch4.0.35
ORiea_softwareradiusxMatch4.0.38
ORiea_softwareradiusxMatch4.0.39
ORiea_softwareradiusxMatch4.0.40
ORiea_softwareradiusxMatch4.0.41
ORiea_softwareradiusxMatch4.0.43
ORiea_softwareradiusxMatch4.0.44
ORiea_softwareradiusxMatch4.0.47
ORiea_softwareradiusxMatch4.0.49
ORiea_softwareradiusxMatch4.0.51
ORiea_softwareradiusxMatch4.0.54
ORiea_softwareradiusxMatch4.0.55
ORiea_softwareradiusxMatch4.0.56
ORiea_softwareradiusxMatch4.0.57
ORiea_softwareradiusxMatch4.0.59
ORiea_softwareradiusxMatch4.0.60
ORiea_softwareradiusxMatch4.0.62
ORiea_softwareradiusxMatch4.0.63
ORiea_softwareradiusxMatch4.0.67
ORiea_softwareradiusxMatch4.0.68
ORiea_softwareradiusxMatch4.0.69
ORiea_softwareradiusxMatch4.0.70
ORiea_softwareradiusxMatch4.0.71
ORiea_softwareradiusxMatch4.0.72
ORiea_softwareradiusxMatch4.0.73
ORiea_softwareradiusxMatch4.0.74
ORiea_softwareradiusxMatch4.0.75
ORiea_softwareradiusxMatch4.0.76
ORiea_softwareradiusxMatch4.0.77
ORiea_softwareradiusxMatch4.0.79
ORiea_softwareradiusxMatch4.0.80
ORiea_softwareradiusxMatch4.0.81
ORiea_softwareradiusxMatch4.0.82
ORiea_softwareradiusxMatch4.0.83
ORiea_softwareradiusxMatch4.0.84
ORiea_softwareradiusxMatch4.0.85
ORiea_softwareradiusxMatch4.0.86
ORiea_softwareradiusxMatch4.0.87
ORiea_softwareradiusxMatch4.0.88
ORiea_softwareradiusxMatch4.0.193
ORiea_softwareradiusxMatch5.0.4a
ORiea_softwareradiusxMatch5.0.7a
ORiea_softwareradiusxMatch5.0.8b
ORiea_softwareradiusxMatch5.0.9b
ORiea_softwareradiusxMatch5.0.10b
ORiea_softwareradiusxMatch5.0.13b
ORiea_softwareradiusxMatch5.0.15b
ORiea_softwareradiusxMatch5.0.17
ORiea_softwareradiusxMatch5.0.22
ORiea_softwareradiusxMatch5.0.27
ORiea_softwareradiusxMatch5.0.29
ORiea_softwareradiusxMatch5.0.31
ORiea_softwareradiusxMatch5.0.35
ORiea_softwareradiusxMatch5.0.36
ORiea_softwareradiusxMatch5.0.38
ORiea_softwareradiusxMatch5.0.39
ORiea_softwareradiusxMatch5.0.42
ORiea_softwareradiusxMatch5.0.43
ORiea_softwareradiusxMatch5.0.45
ORiea_softwareradiusxMatch5.0.49
ORiea_softwareradiusxMatch5.0.50
ORiea_softwareradiusxMatch5.0.54
ORiea_softwareradiusxMatch5.0.55
ORiea_softwareradiusxMatch5.0.57
ORiea_softwareradiusxMatch5.0.58
ORiea_softwareradiusxMatch5.1.3
ORiea_softwareradiusxMatch5.1.4
ORiea_softwareradiusxMatch5.1.5
ORiea_softwareradiusxMatch5.1.6
ORiea_softwareradiusxMatch5.1.10
ORiea_softwareradiusxMatch5.1.15
ORiea_softwareradiusxMatch5.1.16
ORiea_softwareradiusxMatch5.1.17
ORiea_softwareradiusxMatch5.1.19
ORiea_softwareradiusxMatch5.1.24
ORiea_softwareradiusxMatch5.1.25
ORiea_softwareradiusxMatch5.1.29
ORiea_softwareradiusxMatch5.1.35
ORiea_softwareradiusxMatch5.1.38
ORiea_softwareradiusxMatch5.1.40
ORiea_softwareradiusxMatch5.1.41
ORiea_softwareradloginMatch4.0.15
ORiea_softwareradloginMatch4.0.20
References
aluigi.altervista.org/adv/emerdal-adv.txt
secunia.com/advisories/28846
www.iea-software.com/docs/airmarshal1/changes.txt
www.iea-software.com/docs/Emerald5/changes.txt
www.iea-software.com/docs/Radius40/changes.txt
www.securityfocus.com/archive/1/487810/100/200/threaded
www.securityfocus.com/bid/27701
www.vupen.com/english/advisories/2008/0484
Related
cvelist
cvelist
CVE-2008-5284
2008-11-29 02:00:00
nvd
nvd
CVE-2008-5284
2008-11-29 02:30:00
prion
prion
Design/Logic Flaw
2008-11-29 02:30:00
10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
6.7 Medium
AI Score
Confidence
High
0.084 Low
EPSS
Percentile
94.4%
Related for CVE-2008-5284