CVE-2017-10984: Critical severity freeradius vulnerability
An FR-GV-301 issue in FreeRADIUS 3.x before 3.0.15 allows "Write overflow in data2vpwimax()" - this allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code.
Other sources
Out-of-bounds write in data2vpwimax() when sending WiMAX attributes which have the "continuation" flag set, but for which there is no subsequent data was found.
The security impact is possible remote code exectuion by anyone who can send packets which are accepted by the server.
Affected versions: 3.0.0 through 3.0.14, inclusive.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-10984?
CVE-2017-10984 has been classified with a severity rating that can lead to denial of service and possible remote code execution.
How do I fix CVE-2017-10984?
To fix CVE-2017-10984, upgrade FreeRADIUS to version 3.0.15 or later.
Which versions of FreeRADIUS are affected by CVE-2017-10984?
CVE-2017-10984 affects FreeRADIUS versions prior to 3.0.15.
Can CVE-2017-10984 be exploited remotely?
Yes, CVE-2017-10984 can be exploited remotely, allowing attackers to potentially crash the daemon or execute arbitrary code.
What components of FreeRADIUS are vulnerable in CVE-2017-10984?
The vulnerability in CVE-2017-10984 specifically affects the data2vp_wimax() function when handling WiMAX attributes.