Vulnerability Note VU#936683

Multiple implementations of the RADIUS protocol do not adequately validate the vendor-length of the vendor-specific attributes

Overview

Various RADIUS servers and clients permit the passing of vendor-specific and user-specific attributes. Several implementations of RADIUS fail to check the Vendor-Length of the Vendor-Specific attribute. It's possible to cause a denial of service against RADIUS servers with a malformed Vendor-Specific attribute.

I. Description

RADIUS servers and clients fail to validate the Vendor-Length inside Vendor-Specific attributes. The Vendor-Length shouldn't be less than 2. If Vendor-Length is less than 2, the RADIUS server (or client) calculates the attribute length as a negative number. The attribute length is then used in various functions. In most RADIUS servers the function that performs this calculation is rad_recv() or radrecv(). Some applications may use the same logic to validate user-specific attributes and be vulnerable via the same method. For example, YARDRadius contains this vulnerability in the handling of the User-Specific attributes only.

II. Impact

It is possible to cause a denial of service against the RADIUS server with a malformed Vendor-Specific attribute. Though unlikely, if a RADIUS client processes the Vendor-Specific attribute contained in a server response, then the client may also be vulnerable.

III. Solution

Apply a patch or upgrade to the version specified by your vendor.

Systems Affected

Vendor	Status	Date Notified
Alcatel	Not Vulnerable	2-Apr-2002
Apple	Not Vulnerable	19-Feb-2002
Athena Online	Not Vulnerable	12-Mar-2002
Cisco	Not Vulnerable	4-Mar-2002
Cistron	Vulnerable	19-Feb-2002
Conectiva	Vulnerable	7-Mar-2002
FreeBSD	Vulnerable	19-Feb-2002
FreeRADIUS	Vulnerable	27-Feb-2002
Fujitsu	Not Vulnerable	20-Feb-2002
Funk Software	Not Vulnerable	28-Mar-2002
GnuRADIUS	Vulnerable	20-Feb-2002
Hewlett Packard	Not Vulnerable	20-Feb-2002
IBM	Not Vulnerable	20-Feb-2002
ICRADIUS	Vulnerable	20-Feb-2002
Interlink Networks	Not Vulnerable	18-Mar-2002
Juniper Networks	Not Vulnerable	20-Feb-2002
Lucent	Vulnerable	5-Mar-2002
Microsoft	Not Vulnerable	20-Feb-2002
Nbase	Vulnerable	12-Apr-2002
NETBSD	Vulnerable	20-Feb-2002
Open System Consultants	Vulnerable	12-Mar-2002
Process Software	Not Vulnerable	20-Feb-2002
RADIUS	Not Vulnerable	4-Mar-2002
RADIUSClient	Not Vulnerable	20-Feb-2002
Red Hat	Vulnerable	20-Feb-2002
SCO	Not Vulnerable	19-Feb-2002
Secure Computing Corporation	Vulnerable	16-Apr-2002
SGI	Not Vulnerable	20-Feb-2002
Vircom	Not Vulnerable	2-Apr-2002
Wind River Systems	Not Vulnerable	4-Mar-2002
XTRADIUS	Vulnerable	20-Feb-2002
YARD RADIUS	Vulnerable	20-Feb-2002

References

http://www.freeradius.org
http://online.securityfocus.com/bid/4230

Credit

Our thanks to 3APA3A <3APA3A@SECURITY.NNOV.RU> for the report and analysis of this vulnerability.

This document was written by Jason Rafail and is based on information provided by 3APA3A.

Other Information

Date Public:	2001-11-29
Date First Published:	2002-03-04
Date Last Updated:	2002-04-16
CERT Advisory:	CA-2002-06
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	1.77
Document Revision:	18

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader