CVE-2007-2028: freeradius
Vulnerability summary
CVE-2007-2028 is a medium (CVSS 5.0) vulnerability in freeradius. EPSS estimates a 2.48% chance of exploitation in the next 30 days, higher than 84.3% of scored vulnerabilities.
Timeline
- 13-04-2007PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Memory leak in freeRADIUS 1.1.5 and earlier allows remote attackers to cause a denial of service (memory consumption) via a large number of EAP-TTLS tunnel connections using malformed Diameter format attributes, which causes the authentication request to be rejected but does not reclaim VALUE_PAIR data structures.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
2.48%
Chance of exploitation in the next 30 days
Percentile
84%
Versus all other CVEs
30-day change
0.00 pp
From 2.48% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Redhat5 products
- freeradius< 0:1.0.1-2.RHEL3.4 | < 0:1.0.1-3.RHEL4.5 | < 0:1.1.3-1.2.el5
- freeradius-debuginfo< 0:1.0.1-2.RHEL3.4 | < 0:1.0.1-3.RHEL4.5 | < 0:1.1.3-1.2.el5
- freeradius-mysql< 0:1.0.1-3.RHEL4.5 | < 0:1.1.3-1.2.el5
- freeradius-postgresql< 0:1.0.1-3.RHEL4.5 | < 0:1.1.3-1.2.el5
- freeradius-unixODBC< 0:1.0.1-3.RHEL4.5 | < 0:1.1.3-1.2.el5
Debian1 product
- freeradius< 1.1.6-1
Freeradius1 product
- freeradius≤ 1.1.5
3 vendors · 7 products
References
25 links- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11156VDB EntrySignatureX Refsource OVAL
Show all 25 references
- www.freeradius.org/security.htmlX Refsource CONFIRM
