CVE:CVE-2009-3111
CNNVD:CNNVD-200909-148
FreeRadius是一款使用RADIUS协议的开放源代码验证和帐户系统。
FreeRadius的src/lib/radius.c文件的rad_decode()函数在解码畸形报文时存在拒绝服务漏洞。远程攻击者可以通过向radiusd守护程序发送带有0长度Tunnel-Password属性的畸形Access-Request报文导致拒绝服务。
solution:Upgrade freeradius freeradius to a higher version than 1.1.7,0.2,0.3,0.4,0.5,0.8,0.8.1,0.9,0.9.1,0.9.2,0.9.3,1.0.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.1.0,1.1.3,1.1.5,1.1.6,and avoid the version (,1.1.7],0.2,0.3,0.4,0.5,0.8,0.8.1,0.9,0.9.1,0.9.2,0.9.3,1.0.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.1.0,1.1.3,1.1.5,1.1.6