Severity Critical
Remote Yes
Type Arbitrary code execution
A security issue has been found in freeradius <= 2.2.9, where the rad_coalesce() function checks for WiMAX attributes which are too small, but it does not check for WiMAX attributes which are too large. As a result, the server can be convinced to read past the end of an attribute, and to write past the end of memory allocated via malloc(). A remote attacker with the ability to send packets which are accepted by the server can cause a write overflow, possibly leading to remote code execution.
Group Package Affected Fixed Severity Status Ticket
AVG-934 freeradius 2.2.0-1 2.2.9-1 Critical Fixed