CVE-2007-2028: Medium severity FreeRADIUS freeradius vulnerability
Memory leak in freeRADIUS 1.1.5 and earlier allows remote attackers to cause a denial of service (memory consumption) via a large number of EAP-TTLS tunnel connections using malformed Diameter format attributes, which causes the authentication request to be rejected but does not reclaim VALUEPAIR data structures.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-2028?
CVE-2007-2028 is considered a high severity vulnerability due to its potential to cause a denial of service through memory consumption.
How do I fix CVE-2007-2028?
To fix CVE-2007-2028, upgrade to FreeRADIUS version 1.1.6 or later where the memory leak has been addressed.
What systems are affected by CVE-2007-2028?
CVE-2007-2028 affects FreeRADIUS versions 1.1.5 and earlier.
What type of attack does CVE-2007-2028 allow?
CVE-2007-2028 allows remote attackers to launch denial of service attacks by exploiting the memory leak through malformed Diameter format attributes.
Is CVE-2007-2028 still relevant today?
Although CVE-2007-2028 was reported in 2007, it remains relevant for any systems that have not been updated to a version newer than 1.1.5.