CVE-2006-1354

Description

Unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass authentication or cause a denial of service (server crash) via "Insufficient input validation" in the EAP-MSCHAPv2 state machine module.

How to fix CVE-2006-1354

To remediate CVE-2006-1354, upgrade the affected package to a fixed version below.

• Debian/freeradius—upgrade to 1.1.0-1.2 or later

Is CVE-2006-1354 being exploited?

Low — EPSS is 4.8%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 1.1.0-1.2

References (1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2006-1354