Full Disclosure mailing list archives
iDEFENSE Security Advisory 06.21.04 - GNU Radius SNMP Invalid OID Denial of Service Vulnerability
From: idlabs-advisories () idefense com
Date: Mon, 21 Jun 2004 14:34:19 -0400
GNU Radius SNMP Invalid OID Denial of Service Vulnerability iDEFENSE Security Advisory 06.21.04 www.idefense.com/application/poi/display?id=110&type=vulnerabilities June 21, 2004 I. BACKGROUND Radius is a server for remote user authentication and accounting. More information about Radius is available at http://www.gnu.org/software/radius/radius.html II. DESCRIPTION Remote exploitation of a denial of service condition within GNU Radius allows attackers to crash the service. The problem specifically exists in the code for handling SNMP messages. By supplying a malformed packet containing an invalid OID, such as -1, it is possible to cause the server to shutdown, preventing further requests from being handled. The Radius server must have been compiled with the '-enable-snmp' option in order to be vulnerable. III. ANALYSIS Successful exploitation allows unauthenticated remote attackers to cause the radius daemon (radiusd) to crash. This prevents legitimate users from accessing systems reliant upon the affected radius server for authentication. IV. DETECTION iDEFENSE has confirmed the existence of this vulnerability in GNU Radius version 1.1. It is suspected that earlier versions are also affected. Version 1.2 is not vulnerable. V. WORKAROUNDS Ingress filtering of UDP port 161 on all interfaces that should not be receiving SNMP packets may lessen exposure to this vulnerability in affected environments. VI. VENDOR FIX This issue has been fixed in GNU Radius version 1.2. VII. CVE INFORMATION The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2004-0576 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. VIII. DISCLOSURE TIMELINE 02/26/04 Issue acquired by iDEFENSE 06/09/04 Initial vendor contact 06/09/04 iDEFENSE clients notified 06/21/04 Public disclosure IX. CREDIT The discoverer wishes to remain anonymous. Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp X. LEGAL NOTICES Copyright (c) 2004 iDEFENSE, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDEFENSE. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email customerservice () idefense com for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- iDEFENSE Security Advisory 06.21.04 - GNU Radius SNMP Invalid OID Denial of Service Vulnerability idlabs-advisories (Jun 21)