REDHAT-BUG-639397: Low severity FreeRADIUS freeradius vulnerability
It was reported [1],[2] that an error when processing requests queued for more than 30 seconds in src/main/event.c could be exploited to cause the process to crash by sending a large number of requests for an extended period of time.
This flaw seems to only affect 2.1.x and was fixed [3] in 2.1.10.
[1] https://bugs.freeradius.org/bugzilla/showbug.cgi?id=35 [2] http://secunia.com/advisories/41621 [3] http://github.com/alandekok/freeradius-server/commit/ff94dd35673bba1476594299d31ce8293b8bd223
The offending file (event.c), nor the affected function (waitforchildtodie()) are not present in the version of freeradius as provided with Red Hat Enterprise Linux 5 (1.1.3).
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability in REDHAT-BUG-639397?
The vulnerability in REDHAT-BUG-639397 is an error that can cause the FreeRADIUS process to crash when processing requests queued for more than 30 seconds.
Which versions are affected by REDHAT-BUG-639397?
REDHAT-BUG-639397 affects FreeRADIUS versions between 2.1.0 and 2.1.9.
How do I fix REDHAT-BUG-639397?
To fix REDHAT-BUG-639397, upgrade FreeRADIUS to version 2.1.10 or later.
What are the consequences of not addressing REDHAT-BUG-639397?
Not addressing REDHAT-BUG-639397 could lead to service interruptions due to process crashes under heavy request conditions.
Is there a workaround for REDHAT-BUG-639397?
There is no official workaround for REDHAT-BUG-639397, and the recommended action is to upgrade to a secure version.