CVE-2001-1376

HighCVSS 7.5/10Last modified Nov 12, 2026

Description

Buffer overflow in digest calculation function of multiple RADIUS implementations allows remote attackers to cause a denial of service and possibly execute arbitrary code via shared secret data.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/linux/suse/2002-q2/0362.html
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000466
http://marc.info/?l=bugtraq&m=101537153021792&w=2
http://online.securityfocus.com/archive/1/239784Vendor Advisory
http://www.cert.org/advisories/CA-2002-06.htmlPatch, Third Party Advisory, US Government Resource
http://www.kb.cert.org/vuls/id/589523US Government Resource
http://www.redhat.com/support/errata/RHSA-2002-030.html
http://www.securityfocus.com/bid/3530Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/7534
http://archives.neohapsis.com/archives/linux/suse/2002-q2/0362.html
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000466
http://marc.info/?l=bugtraq&m=101537153021792&w=2
http://online.securityfocus.com/archive/1/239784Vendor Advisory
http://www.cert.org/advisories/CA-2002-06.htmlPatch, Third Party Advisory, US Government Resource
http://www.kb.cert.org/vuls/id/589523US Government Resource
http://www.redhat.com/support/errata/RHSA-2002-030.html
http://www.securityfocus.com/bid/3530Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/7534

Timeline

Published: Mar 4, 2002
Last modified: Nov 12, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-13775.0Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers t CVE-2001-13782.1fetchmailconf in fetchmail before 5.7.4 allows local users to overwrite files of other users via a symlink attack on temporary files.CVE-2001-13797.5The PostgreSQL authentication modules (1) mod_auth_pgsql 0.9.5, and (2) mod_auth_pgsql_sys 0.9.4, allow remote attackers to bypass authentic CVE-2001-13807.5OpenSSH before 2.9.9, while using keypairs and multiple keys of different types in the ~/.ssh/authorized_keys2 file, may not properly handle CVE-2001-13825.0The "echo simulation" traffic analysis countermeasure in OpenSSH before 2.9.9p2 sends an additional echo packet after the password and carri CVE-2001-13836.2initscript in setserial 2.17-4 and earlier uses predictable temporary file names, which could allow local users to conduct unauthorized oper CVE-2001-13847.2ptrace in Linux 2.2.x through 2.2.19, and 2.4.x through 2.4.9, allows local users to gain root privileges by running ptrace on a setuid or s CVE-2001-13855.0The Apache module for PHP 4.0.0 through PHP 4.0.4, when disabled with the 'engine = off' option for a virtual host, may disable PHP for othe CVE-2001-13867.5WFTPD 3.00 allows remote attackers to read arbitrary files by uploading a (link) file that ends in a ".lnk." extension, which bypasses WFTPD CVE-2001-13872.1iptables-save in iptables before 1.2.4 records the "--reject-with icmp-host-prohibited" rule as "--reject-with tcp-reset," which causes ipta CVE-2001-13885.0iptables before 1.2.4 does not accurately convert rate limits that are specified on the command line, which could allow attackers or users t CVE-2001-13897.5Multiple vulnerabilities in xinetd 2.3.0 and earlier, and additional variants until 2.3.3, may allow remote attackers to cause a denial of s