It was reported [1],[2] that an error when processing requests queued for more than 30 seconds in src/main/event.c could be exploited to cause the process to crash by sending a large number of requests for an extended period of time.

This flaw seems to only affect 2.1.x and was fixed [3] in 2.1.10.

[1] https://bugs.freeradius.org/bugzilla/showbug.cgi?id=35 [2] http://secunia.com/advisories/41621 [3] http://github.com/alandekok/freeradius-server/commit/ff94dd35673bba1476594299d31ce8293b8bd223

The offending file (event.c), nor the affected function (waitforchildtodie()) are not present in the version of freeradius as provided with Red Hat Enterprise Linux 5 (1.1.3).