A security issue has been reported in FreeRADIUS, which can be exploited by malicious people to cause a DoS (Denial of Service).
The security issue is caused due to a memory leak (ca. 300bytes) within the handling of certain malformed diameter format values inside an EAP-TTLS tunnel. This can be exploited to exhaust all available memory by sending a large number of malformed authentication requests to a vulnerable server.
The security issue is reported in versions prior to 1.1.6.
Solution: Update to version 1.1.6.
Provided and/or discovered by: The vendor credits the Coverity Project.
Original Advisory: http://www.freeradius.org/security.html
Do you have additional information related to this advisory?
Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this
information to firstname.lastname@example.org