CVE-2010-3696: Medium severity FreeRADIUS freeradius vulnerability
It was reported [1],[2] that an error when processing DHCP requests with the 'Relay Agent Information' option (82) in src/lib/dhcp.c could be exploited to cause an infinite loop, in the process denying further requests via a packet with multiple sub-options.
According to the upstream report, this flaw seems to only affect 2.1.9 and was fixed [3] in 2.1.10.
[1] https://bugs.freeradius.org/bugzilla/showbug.cgi?id=77 [2] http://secunia.com/advisories/41621 [3] http://github.com/alandekok/freeradius-server/commit/4dc7800b866f889a1247685bbaa6dd4238a56279
The offending file (dhcp.c) is not present in the version of freeradius as provided with Red Hat Enterprise Linux 5 (1.1.3).
Other sources
The frdhcpdecode function in lib/dhcp.c in FreeRADIUS 2.1.9, in certain non-default builds, does not properly handle the DHCP Relay Agent Information option, which allows remote attackers to cause a denial of service (infinite loop and daemon outage) via a packet that has more than one sub-option. NOTE: some of these details are obtained from third party information.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3696?
CVE-2010-3696 has a high severity level as it can cause an infinite loop during DHCP request processing.
How do I fix CVE-2010-3696?
To fix CVE-2010-3696, you should update FreeRADIUS to a version that includes the patch for this vulnerability.
What versions are affected by CVE-2010-3696?
CVE-2010-3696 specifically affects FreeRADIUS version 2.1.9.
What is the impact of CVE-2010-3696?
The impact of CVE-2010-3696 includes denial of service due to the infinite loop caused by malformed DHCP requests.
Is CVE-2010-3696 easy to exploit?
Yes, CVE-2010-3696 can be easily exploited by sending a DHCP request with multiple sub-options.