CVE-2004-0938
published 2004-11-03CVE-2004-0938: FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (server crash) by sending an Ascend-Send-Secret attribute without the required…
PriorityP417medium5CVSS 2.0
AVNACLAuNCNINAP
EPSS
3.65%
88.4th percentile
FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (server crash) by sending an Ascend-Send-Secret attribute without the required leading packet.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | freeradius | < freeradius 1.0.1 (bookworm) | freeradius 1.0.1 (bookworm) |
| freeradius | freeradius | <= 1.0.1 | — |
| freeradius | freeradius | >= 0 < 1.0.1 | 1.0.1 |
| freeradius | freeradius | >= 0 < 1.0.1 | 1.0.1 |
| freeradius | freeradius | >= 0 < 1.0.1 | 1.0.1 |
| freeradius | freeradius | >= 0 < 1.0.1 | 1.0.1 |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv5.0MEDIUM
vendor_debian5.0MEDIUM
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3vc7-3jff-2j8g: FreeRADIUS before 1
ghsa_unreviewed·2022-04-29
CVE-2004-0938 [MEDIUM] GHSA-3vc7-3jff-2j8g: FreeRADIUS before 1
FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (server crash) by sending an Ascend-Send-Secret attribute without the required leading packet.
OSV
CVE-2004-0938: FreeRADIUS before 1
osv·2004-11-03·CVSS 5.0
CVE-2004-0938 [MEDIUM] CVE-2004-0938: FreeRADIUS before 1
FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (server crash) by sending an Ascend-Send-Secret attribute without the required leading packet.
Red Hat
security flaw
vendor_redhat·2004-09-20·CVSS 5.0
CVE-2004-0938 [MEDIUM] security flaw
security flaw
FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (server crash) by sending an Ascend-Send-Secret attribute without the required leading packet.
Debian
CVE-2004-0938: freeradius - FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (se...
vendor_debian·2004·CVSS 5.0
CVE-2004-0938 [MEDIUM] CVE-2004-0938: freeradius - FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (se...
FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (server crash) by sending an Ascend-Send-Secret attribute without the required leading packet.
Scope: local
bookworm: resolved (fixed in 1.0.1)
bullseye: resolved (fixed in 1.0.1)
forky: resolved (fixed in 1.0.1)
sid: resolved (fixed in 1.0.1)
trixie: resolved (fixed in 1.0.1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2004-0938 security flaw
bugzilla·2018-08-16·CVSS 5.0
CVE-2004-0938 [MEDIUM] CVE-2004-0938 security flaw
CVE-2004-0938 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (server crash) by sending an Ascend-Send-Secret attribute without the required leading packet.
Bugzilla
CAN-2004-0938 Freeradius < 1.0.1 DoS and remote crash (CAN-2004-0960, CAN-2004-0961)
bugzilla·2004-10-15
[HIGH] CAN-2004-0938 Freeradius < 1.0.1 DoS and remote crash (CAN-2004-0960, CAN-2004-0961)
CAN-2004-0938 Freeradius < 1.0.1 DoS and remote crash (CAN-2004-0960, CAN-2004-0961)
Description of problem:
Remote Denial Of Service, and remote crash by sending malformed packets.
Version-Release number of selected component (if applicable):
All version of Freeradius prior to version 1.0.1 (to check)
From the freeradius ChangeLog:
FreeRADIUS 1.0.1 ; $Date: 2004/09/02 10:52:03 $, urgency=high
Denial-of-Service Security Fix
* Fix two remote crashes and a memory leak in RADIUS packet
decoding.
No CAN numbers have been associated with this issue:
http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=freeradius
Discussion:
http://www.kb.cert.org/vuls/id/541574
http://secunia.com/advisories/12570/
Removing security-sensitive tag as this issue is public.
---
RHSA-2004:609 in progress which w
http://security.gentoo.org/glsa/glsa-200409-29.xmlhttp://www.kb.cert.org/vuls/id/541574http://www.osvdb.org/10178http://www.securityfocus.com/bid/11222https://exchange.xforce.ibmcloud.com/vulnerabilities/17440https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10837https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1347http://security.gentoo.org/glsa/glsa-200409-29.xmlhttp://www.kb.cert.org/vuls/id/541574http://www.osvdb.org/10178http://www.securityfocus.com/bid/11222https://exchange.xforce.ibmcloud.com/vulnerabilities/17440https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10837https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1347
2004-11-03
Published