CVE-2012-3547

Name of the Vulnerable Software and Affected Versions FreeRADIUS versions 2.1.10 through 2.1.12

Description The issue is related to a stack-based buffer overflow in the cbtls verify function when using TLS-based EAP methods. This can be triggered by a remote attacker sending a client certificate with a long "not after" timestamp, potentially causing a denial of service (server crash) and possibly allowing the execution of arbitrary code. Multiple vulnerabilities in the FreeRADIUS package may lead to breaches of confidentiality, integrity, and availability of protected information, and these can be exploited remotely.

Recommendations For FreeRADIUS versions 2.1.10 through 2.1.12, consider updating to a version that fixes the cbtls verify function issue to prevent potential code execution and denial of service attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.