{"id":"CVE-2003-0967","aliases":["DEBIAN-CVE-2003-0967","EUVD-2003-0957","GHSA-4j6g-2g2g-f47h","RHSA-2003:386"],"status":"published","title":"rad_decode in FreeRADIUS 0.9.2 and earlier allows remote attackers to cause a denial of service ...","description":"rad_decode in FreeRADIUS 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a short RADIUS string attribute with a tag, which causes memcpy to be called with a -1 length argument, as demonstrated using the Tunnel-Password attribute.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.04755,"percentile":0.91938,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"published":"2003-12-02T05:00:00Z","modified":"2026-10-22T23:47:25Z","exploits":[{"source":"exploitdb","id":"EDB-23391","title":"FreeRadius 0.x/1.1.x - Tag Field Heap Corruption","type":"dos","platform":"linux","date":"2003-11-20","verified":true,"url":"https://www.exploit-db.com/exploits/23391"}],"fixes":[{"ecosystem":"Debian:12","package":"freeradius","fixed_in":["0.9.2-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"freeradius","fixed_in":["0.9.2-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"freeradius","fixed_in":["0.9.2-4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::as","package":"freeradius","fixed_in":["0:0.9.3-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::as","package":"freeradius-debuginfo","fixed_in":["0:0.9.3-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::es","package":"freeradius","fixed_in":["0:0.9.3-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::es","package":"freeradius-debuginfo","fixed_in":["0:0.9.3-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::as","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.3-1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::as","package":"freeradius-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.3-1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::es","package":"freeradius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.3-1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::es","package":"freeradius-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.3-1"}]}]}],"products":[{"vendor":"freeradius","product":"freeradius"}],"references":[{"url":"http://marc.info/?l=bugtraq\u0026m=106935911101493\u0026w=2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://marc.info/?l=freeradius-users\u0026m=106947389449613\u0026w=2","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.redhat.com/support/errata/RHSA-2003-386.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10917","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=106944220426970","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2003-0967","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4j6g-2g2g-f47h"},{"url":"https://security-tracker.debian.org/tracker/CVE-2003-0967","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2003:386","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"http://marc.theaimsgroup.com/?l=freeradius-users\u0026m=106947389449613","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=110901","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2003/rhsa-2003_386.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2003-0967","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1617109","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2003-0967","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2003-0967","description":"rad_decode in FreeRADIUS 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a short RADIUS string attribute with a tag, which causes memcpy to be called with a -1 length argument, as demonstrated using the Tunnel-Password attribute.","status":"published","published":"2003-12-02T05:00:00Z","modified":"2024-08-08T02:12:34.859Z","updated_at":"2026-11-02T14:20:16.411288Z"}],"euvd":[{"id":"EUVD-2003-0957","description":"rad_decode in FreeRADIUS 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a short RADIUS string attribute with a tag, which causes memcpy to be called with a -1 length argument, as demonstrated using the Tunnel-Password attribute.","status":"published","published":"2003-12-02T05:00:00Z","modified":"2024-08-08T02:12:34Z","updated_at":"2026-11-03T01:15:05.487655Z"}],"ghsa":[{"id":"GHSA-4j6g-2g2g-f47h","title":"rad_decode in FreeRADIUS 0.9.2 and earlier allows remote attackers to cause a denial of service ...","description":"rad_decode in FreeRADIUS 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a short RADIUS string attribute with a tag, which causes memcpy to be called with a -1 length argument, as demonstrated using the Tunnel-Password attribute.","status":"published","published":"2022-04-29T01:27:16Z","modified":"2023-01-30T05:01:43Z","updated_at":"2026-11-02T14:46:28.346354Z"}],"nvd":[{"id":"CVE-2003-0967","description":"rad_decode in FreeRADIUS 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a short RADIUS string attribute with a tag, which causes memcpy to be called with a -1 length argument, as demonstrated using the Tunnel-Password attribute.","status":"published","published":"2003-12-15T05:00:00Z","modified":"2026-06-16T22:03:15.497Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:00:47.41445Z"}],"osv":[{"id":"CVE-2003-0967","description":"rad_decode in FreeRADIUS 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a short RADIUS string attribute with a tag, which causes memcpy to be called with a -1 length argument, as demonstrated using the Tunnel-Password attribute.","status":"published","published":"2003-12-15T05:00:00Z","modified":"2026-04-10T03:36:20.622193Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"DEBIAN-CVE-2003-0967","description":"rad_decode in FreeRADIUS 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a short RADIUS string attribute with a tag, which causes memcpy to be called with a -1 length argument, as demonstrated using the Tunnel-Password attribute.","status":"published","published":"2003-12-15T05:00:00Z","modified":"2026-10-22T23:47:25.372276486Z","updated_at":"2026-11-02T15:45:22.55978Z"},{"id":"RHSA-2003:386","title":"Red Hat Security Advisory: freeradius security update","status":"published","published":"2024-09-12T22:06:21Z","modified":"2026-06-26T10:00:53Z","updated_at":"2026-11-02T15:52:59.135214Z"}]}}