CVE-2017-10979: Critical severity freeradius vulnerability
An FR-GV-202 issue in FreeRADIUS 2.x before 2.2.10 allows "Write overflow in radcoalesce()" - this allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code.
Other sources
The radcoalesce() function checks for WiMAX attributes which are too small, but it does not check for WiMAX attributes which are too large. As a result, the server can be convinced to read past the end of an attribute, and to write past the end of memory allocated via malloc().
The data being copied is taken from the attributes following the malformed WiMAX attribute, and is under the control of the attacker. While the packet has to be a "well formed" RADIUS packet, that requirement limits only the two octets which immediately follow the malformed WiMAX attribute. After that, there are up to 245 octets copied which are the complete control of the attacker.
The issue happens when the server receives any packet containing malformed WiMAX attributes, potentially leading to remote code execution.
Affected versions: 2.0.0 through 2.2.9, inclusive.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-10979?
CVE-2017-10979 has a high severity level due to its ability to cause denial of service and potentially allow for arbitrary code execution.
How do I fix CVE-2017-10979?
To fix CVE-2017-10979, upgrade to FreeRADIUS version 2.2.10 or later.
Which FreeRADIUS versions are affected by CVE-2017-10979?
CVE-2017-10979 affects FreeRADIUS versions prior to 2.2.10 including 2.0.x and 2.1.x series.
What types of vulnerabilities does CVE-2017-10979 present?
CVE-2017-10979 presents a write overflow vulnerability that may result in application crashes and exploitation risks.
Can CVE-2017-10979 be exploited remotely?
Yes, CVE-2017-10979 can be exploited remotely by attackers to initiate a denial of service attack.