CVE-2004-0960

FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (core dump) via...

5.0 MediumFix available

CVE-2004-0960 is a medium vulnerability (CVSS 5.0) in Freeradius, published October 20, 2004. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.23%, the 88th percentile. Fixed in freeradius 1.0.1.

What does this mean?

Severity: 5.0 MediumCVSS 2.0, NVD
Exploit chance: 3.23%EPSS, 88th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 1.0.1freeradius +6 more

Description

FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (core dump) via malformed USR vendor-specific attributes (VSA) that cause a memcpy operation with a -1 argument.

Exploit likelihood

3.23%Up 2.0 points since Feb 4, 2022

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`freeradius` Debian:12	before 1.0.1	1.0.1
`freeradius` Debian:13	before 1.0.1	1.0.1
`freeradius` Debian:14	before 1.0.1	1.0.1
`freeradius` Red Hat:enterprise_linux:3::as From an advisory covering 3 CVEs	before 0:1.0.1-1.RHEL3	0:1.0.1-1.RHEL3
`freeradius-debuginfo` Red Hat:enterprise_linux:3::as From an advisory covering 3 CVEs	before 0:1.0.1-1.RHEL3	0:1.0.1-1.RHEL3
`freeradius` Red Hat:enterprise_linux:3::es From an advisory covering 3 CVEs	before 0:1.0.1-1.RHEL3	0:1.0.1-1.RHEL3
`freeradius-debuginfo` Red Hat:enterprise_linux:3::es From an advisory covering 3 CVEs	before 0:1.0.1-1.RHEL3	0:1.0.1-1.RHEL3

What each source reports

NVD Score used5.0

FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (core dump) via malformed USR vendor-specific attributes (VSA) that cause a memcpy operation with a -1 argument.

Record: CVE-2004-0960
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Updated: 2026-11-02

CVE ListNo score

FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (core dump) via malformed USR vendor-specific attributes (VSA) that cause a memcpy operation with a -1 argument.

Record: CVE-2004-0960
Updated: 2026-11-02

EUVDEUVD-2004-0958No score

FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (core dump) via malformed USR vendor-specific attributes (VSA) that cause a memcpy operation with a -1 argument.

Record: EUVD-2004-0958
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xw3g-88p6-48wmNo score

FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (core dump) via...

FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (core dump) via malformed USR vendor-specific attributes (VSA) that cause a memcpy operation with a -1 argument.

Record: GHSA-xw3g-88p6-48wm
Updated: 2026-11-02

OSVNo score

FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (core dump) via malformed USR vendor-specific attributes (VSA) that cause a memcpy operation with a -1 argument.

Record: CVE-2004-0960
Updated: 2026-11-02

OSVDEBIAN-CVE-2004-0960No score

FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (core dump) via malformed USR vendor-specific attributes (VSA) that cause a memcpy operation with a -1 argument.

Record: DEBIAN-CVE-2004-0960
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 21 moreShow less