CVE-2012-3547: Buffer Overflow
Published Sep 18, 2012
·Updated
Stack-based buffer overflow in the cbtlsverify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long "not after" timestamp in a client certificate.
Affected Software
3 affected components
FreeRADIUS freeradius=2.1.10
FreeRADIUS freeradius=2.1.11
FreeRADIUS freeradius=2.1.12
Event History
Sep 18, 2012
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-3547?
CVE-2012-3547 has a high severity level due to its potential to cause denial of service and execute arbitrary code.
2
How do I fix CVE-2012-3547?
To resolve CVE-2012-3547, upgrade FreeRADIUS to version 2.1.13 or later, where the vulnerability is patched.
3
What are the affected versions for CVE-2012-3547?
Versions 2.1.10, 2.1.11, and 2.1.12 of FreeRADIUS are affected by CVE-2012-3547.
4
What type of vulnerability is CVE-2012-3547?
CVE-2012-3547 is a stack-based buffer overflow vulnerability.
5
Can CVE-2012-3547 lead to remote code execution?
Yes, CVE-2012-3547 can potentially allow remote attackers to execute arbitrary code.