| Package | Affected versions | Patched versions |
|---|---|---|
| freeradius | = 0.2= 0.3 | |
| radius | = 0.92.1= 0.93= 0.94= 0.95 | |
| icradius | = 0.14= 0.15= 0.16= 0.17= 0.17b= 0.18= 0.18.1 | |
| radius | = 2.0= 2.0.1= 2.1 | |
| radius | = 2.0= 2.0.1= 2.1 | |
| radius | = 1.6.1= 1.6.2= 1.6.3= 1.6.4= 1.6.5= 1.6_.0 | |
| openradius | = 0.8= 0.9= 0.9.1= 0.9.2= 0.9.3 | |
| radiusclient | = 0.3.1 | |
| xtradius | = 1.1_pre1= 1.1_pre2 | |
| yard radius | = 1.0.17= 1.0.18= 1.0.19= 1.0_pre13= 1.0_pre14= 1.0_pre15 | |
| yard radius | = 1.0.16 |
Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers to cause a denial of service (crash) via a Vendor-Length that is less than 2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free