EUVD-2015-8637

Malware in sbrugna...

NewStart CGSL CORE 5.04 / MAIN 5.04 : freeradius Multiple Vulnerabilities (NS-SA-2021-0037)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has freeradius packages installed that are affected by multiple vulnerabilities: - In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BNCTX instance to handle all handshakes. This mean multiple threads...

CVE-2015-8763

The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to have unspecified impact via a crafted 1 commit or 2 confirm message, which triggers an out-of-bounds read...

CVE-2015-8764

Off-by-one error in the EAP-PWD module in FreeRADIUS 3.0 through 3.0.8, which triggers a buffer overflow...

CVE-2015-8762

The CVE-2015-8762 entry concerns the EAP-PWD module in FreeRADIUS versions 3.0 through 3.0.8. The vulnerability allows remote attackers to cause a denial of service via a zero-length EAP-PWD packet, triggering a NULL pointer dereference that can crash the server. Connected sources consistently re...

FreeRadius EAP-PWD module buffer overflow vulnerability

FreeRadius is a suite of software that implements the RADIUS protocol from the FreeRADIUS Server project. The EAP-PWD module of FreeRadius fails to validate the length of the commit message load, allowing remote attackers to exploit the vulnerability to submit special requests for denial-of-servi...

FreeRadius EAP-PWD Module Denial of Service Vulnerability

FreeRadius is a suite of software that implements the RADIUS protocol from the FreeRADIUS Server project. The EAP-PWD module of FreeRadius does not check packet lengths, allowing remote attackers to exploit vulnerabilities to submit special requests for denial-of-service attacks...

freeradius3 -- insufficient validation on packets

Jouni Malinen reports: The EAP-PWD module performed insufficient validation on packets received from an EAP peer. This module is not enabled in the default configuration. Administrators must manually enable it for their server to be vulnerable. Only versions 3.0 up to 3.0.8 are affected...