kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Document freeradius remote packet of death exploit (CVE 2009-3111)

Browse source 
Submitted by:	"Danilo G. Baio" <dbaio bs2 com br>
PR:		ports/141318
This commit is contained in:
Xin LI 2009-12-15 00:39:19 +00:00
parent ad44fd6533
commit acd77904d5
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=245809
1 changed files with 35 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

35
security/vuxml/vuln.xml
View file

@ -35,6 +35,41 @@ Note: Please add new entries to the beginning of this file.
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="1b3f854b-e4bd-11de-b276-000d8787e1be">
<topic> freeradius -- A free RADIUS server implementation </topic>
<affects>
<package>
<name>freeradius</name>
<range><lt>1.1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>freeRADIUS Vulnerability Notifications reports:</p>
<blockquote cite="http://freeradius.org/security.html">
<p>2009.09.09 v1.1.7 - Anyone who can send packets to
the server can crash it by sending a Tunnel-Password
attribute in an Access-Request packet. This
vulnerability is not otherwise exploitable. We have
released 1.1.8 to correct this vulnerability.</p>
<p>This issue is similar to the previous Tunnel-Password
issue noted below. The vulnerable versions are 1.1.3
through 1.1.7. Version 2.x is not affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2009-3111</cvename>
<url>http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3111</url>
<url>http://freeradius.org/security.html</url>
<url>http://www.milw0rm.com/exploits/9642</url>
</references>
<dates>
<discovery>2009-09-09</discovery>
<entry>2009-12-14</entry>
</dates>
</vuln>
<vuln vid="bec38383-e6cb-11de-bdd4-000c2930e89b">
<topic>pligg -- Cross-Site Scripting and Cross-Site Request Forgery</topic>
<affects>