CVE-2007-2028

Memory leak in freeRADIUS 1.1.5 and earlier allows remote attackers to cause a denial of service memory consumption via a large number of EAP-TTLS tunnel connections using malformed Diameter format attributes, which causes the authentication request to be rejected but does not reclaim VALUEPAIR...

CVE-2007-2028

Memory leak in freeRADIUS 1.1.5 and earlier allows remote attackers to cause a denial of service memory consumption via a large number of EAP-TTLS tunnel connections using malformed Diameter format attributes, which causes the authentication request to be rejected but does not reclaim VALUEPAIR...

freeradius -- EAP-TTLS Tunnel Memory Leak Remote DOS Vulnerability

The freeradius development team reports: A malicious 802.1x supplicant could send malformed Diameter format attributes inside of an EAP-TTLS tunnel. The server would reject the authentication request, but would leak one VALUEPAIR data structure, of approximately 300 bytes. If an attacker performe...

CVE-2006-5601

Stack-based buffer overflow in the eapdonotify function in eap.c in xsupplicant before 1.2.6, and possibly other versions, allows remote authenticated users to execute arbitrary code via unspecified vectors...

FreeBSD : freeradius -- authentication bypass vulnerability (1a216dfd-f710-11da-9156-000e0c2e438a)

The freeradius development team reports : A validation issue exists with the EAP-MSCHAPv2 module in all versions from 1.0.0 where the module first appeared to 1.1.0. Insufficient input validation was being done in the EAP-MSCHAPv2 state machine. A malicious attacker could manipulate their...

freeradius -- authentication bypass vulnerability

The freeradius development team reports: A validation issue exists with the EAP-MSCHAPv2 module in all versions from 1.0.0 where the module first appeared to 1.1.0. Insufficient input validation was being done in the EAP-MSCHAPv2 state machine. A malicious attacker could manipulate their...

FreeBSD : freeradius -- EAP-MSCHAPv2 Authentication Bypass (37a5c10f-bf56-11da-b0e9-00123ffe8333)

Freeradius Security Contact reports : Insufficient input validation was being done in the EAP-MSCHAPv2 state machine. A malicious attacker could manipulate their EAP-MSCHAPv2 client state machine to potentially convince the server to bypass authentication checks. This bypassing could also result ...

GLSA-200604-03 : FreeRADIUS: Authentication bypass in EAP-MSCHAPv2 module

The remote host is affected by the vulnerability described in GLSA-200604-03 FreeRADIUS: Authentication bypass in EAP-MSCHAPv2 module FreeRADIUS suffers from insufficient input validation in the EAP-MSCHAPv2 state machine. Impact : An attacker could cause the server to bypass authentication check...

security flaw

Unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass authentication or cause a denial of service server crash via "Insufficient input validation" in the EAP-MSCHAPv2 state machine module...

FreeRADIUS: Authentication bypass in EAP-MSCHAPv2 module

Background FreeRADIUS is an open source RADIUS authentication server implementation. Description FreeRADIUS suffers from insufficient input validation in the EAP-MSCHAPv2 state machine. Impact An attacker could cause the server to bypass authentication checks by manipulating the EAP-MSCHAPv2 clie...

SUSE-SA:2006:019: freeradius

The remote host is missing the patch for the advisory SUSE-SA:2006:019 freeradius. Insufficient input validation was being done in the EAP-MSCHAPv2 state machine of the FreeRADIUS authentication server. A malicious attacker could manipulate their EAP-MSCHAPv2 client state machine to potentially...

Mandrake Linux Security Advisory : freeradius (MDKSA-2006:060)

An unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass authentication or cause a denial of service server crash via 'Insufficient input validation' in the EAP-MSCHAPv2 state machine module. Updated packages have been patched to correct this issue...

CVE-2006-1354

Unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass authentication or cause a denial of service server crash via "Insufficient input validation" in the EAP-MSCHAPv2 state machine module...

CVE-2006-1354

Unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass authentication or cause a denial of service server crash via "Insufficient input validation" in the EAP-MSCHAPv2 state machine module...

CVE-2006-1354

Unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass authentication or cause a denial of service server crash via "Insufficient input validation" in the EAP-MSCHAPv2 state machine module...

CVE-2006-1354

CVE-2006-1354 affects FreeRADIUS 1.0.0–1.1.0. The root cause is insufficient input validation in the EAP-MSCHAPv2 state machine, allowing a remote attacker over the network to bypass authentication or cause a denial of service (server crash). Connected OpenVAS entries and advisories corroborate t...

CVE-2006-1354

Unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass authentication or cause a denial of service server crash via "Insufficient input validation" in the EAP-MSCHAPv2 state machine module...

Vulnerability Notifications

2006.03.20 v1.0.5, and v1.1.0 - A validation issue exists with the EAP-MSCHAPv2 module in all versions from 1.0.0 where the module first appeared to 1.1.0. Insufficient input validation was being done in the EAP-MSCHAPv2 state machine. A malicious attacker could manipulate their EAP-MSCHAPv2 clie...

FreeRADIUS EAP authentication bypass and DoS

EAP-MSCHAPv2 implementation problems...

freeradius -- EAP-MSCHAPv2 Authentication Bypass

Freeradius Security Contact reports: Insufficient input validation was being done in the EAP-MSCHAPv2 state machine. A malicious attacker could manipulate their EAP-MSCHAPv2 client state machine to potentially convince the server to bypass authentication checks. This bypassing could also result i...