CVE-2017-10978: Buffer Overflow
An FR-GV-201 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "Read / write overflow in makesecret()" and a denial of service.
Other sources
The makesecret() function does not properly check for output buffer size before writing data. It can perform a read or write overflow of up to 16 octets.
The issue can happen when when the server is sending a RADIUS packet that is almost at the maximum (4K octets), and the last attribute in the packet is an Ascend-Send-Secret (or similar) attribute. The data being written is an MD5 digest of the shared secret, concatenated to data which is under the attackers control.
This issue can also happen when receiving a packet that has an Ascend-Send-Secret (or similar) attribute of the wrong size. The server will read data past the end of the attribute, up to a limit of 16 octets.
The security impact is denial of service by anyone who can send packets which are accepted by the server.
Affected versions: 2.0.0 through 3.0.14, inclusive.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-10978?
CVE-2017-10978 has a severity rating that indicates it could lead to a denial of service due to a read/write overflow.
How do I fix CVE-2017-10978?
To fix CVE-2017-10978, you should upgrade FreeRADIUS to version 2.2.10 or 3.0.15 or later.
Which versions of FreeRADIUS are affected by CVE-2017-10978?
FreeRADIUS versions prior to 2.2.10 and versions prior to 3.0.15 are affected by CVE-2017-10978.
Can CVE-2017-10978 lead to data compromise?
CVE-2017-10978 primarily leads to denial of service and does not directly indicate potential for data compromise.
Is there a specific function that causes the vulnerability in CVE-2017-10978?
The vulnerability in CVE-2017-10978 is caused by improper buffer size checks in the make_secret() function.