CVE-2009-3111 Denial of service in n/a

Medium 5.0 Published 9 Sep 2009 Updated 7 Aug 2024

Remote attackers can crash the FreeRADIUS server by sending zero-length Tunnel-Password attributes, causing a denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2009-3111?

CVE-2009-3111 is a medium-severity denial of service vulnerability in n/a, published on 9 Sep 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The rad_decode function in FreeRADIUS before 1.1.8 allows remote attackers to cause a denial of service (radiusd crash) via zero-length Tunnel-Password attributes, as demonstrated by a certain module in VulnDisco Pack Professional 7.6 through 8.11. NOTE: this is a regression error related to CVE-2003-0967.

Which versions are affected by CVE-2009-3111?

It affects 1 product.

Linux distribution packages (10)

`freeradius` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:1.1.3-1.5.el5_4`
`freeradius-debuginfo` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:1.1.3-1.5.el5_4`
`freeradius-mysql` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:1.1.3-1.5.el5_4`
`freeradius-postgresql` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:1.1.3-1.5.el5_4`
`freeradius-unixODBC` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:1.1.3-1.5.el5_4`
`freeradius` Red Hat:enterprise_linux:5::server	All versions	`0:1.1.3-1.5.el5_4`
`freeradius-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:1.1.3-1.5.el5_4`
`freeradius-mysql` Red Hat:enterprise_linux:5::server	All versions	`0:1.1.3-1.5.el5_4`
`freeradius-postgresql` Red Hat:enterprise_linux:5::server	All versions	`0:1.1.3-1.5.el5_4`
`freeradius-unixODBC` Red Hat:enterprise_linux:5::server	All versions	`0:1.1.3-1.5.el5_4`

Products include Freeradius Freeradius.

How do I fix CVE-2009-3111?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2009-3111 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-3111 exists.

Public exploit code: 1 Exploit-DB entry.

Sources

Also known as CVE-2009-4481, DEBIAN-CVE-2009-3111, GHSA-q2fp-fcx5-hff3, RHSA-2009:1451.