FreeRADIUS versions 0.9.2 and below have a tunnel-password attribute handling vulnerability. When a malformed attribute trigger gets passed, the server invokes memcpy() with a negative third argument, causing a crash.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/32242/squadra.txt
Source: https://packetstormsecurity.com/files/32242/squadra.txt.html