Security Update for freeradius
Summary
DLA-977-1: freeradius - security update. Affects freeradius versions < 2.1.12+dfsg-1.2+deb7u1. Fixed in 2.1.12+dfsg-1.2+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeRADIUS is a high-performance and highly configurable RADIUS server. It is used for authenticating network users and authorizing their access to resources. The server supports various authentication methods, including PAP, CHAP, MS-CHAP, EAP, and more. FreeRADIUS is widely used in enterprise networks and provides a robust and scalable solution for network authentication.
Vulnerability Detail
A stack-based buffer overflow vulnerability (CVE-2014-2015) was discovered in the normify function of the rlm_pap module in FreeRADIUS. This vulnerability can be exploited by existing users to cause a denial of service or potentially execute arbitrary code. Another vulnerability (CVE-2015-4680) allows the acceptance of client certificates issued by revoked certificates from intermediate CAs, bypassing the revocation check. Additionally, the TLS session cache in FreeRADIUS fails to reliably prevent resumption of an unauthenticated session (CVE-2017-9148), enabling remote attackers to bypass authentication via PEAP or TTLS.
How To Fix
Minimum fixed version
2.1.12+dfsg-1.2+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade freeradiusTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
To enable checking of intermediate CA certificates and prevent the acceptance of revoked client certificates, you need to enable the check_all_crl option in the EAP TLS section of the eap.conf file. This is only necessary for servers using certificates signed by intermediate CAs. Servers that use self-signed CAs are unaffected.
Conclusion
Upgrading your FreeRADIUS packages to the fixed version is crucial to mitigate the vulnerabilities and ensure the security of your network authentication system. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for freeradius →
FAQ
FreeRADIUS is a high-performance and highly configurable RADIUS server used for network authentication and authorization.
The stack-based buffer overflow vulnerability in FreeRADIUS can be exploited by existing users to cause a denial of service or potentially execute arbitrary code.
To fix the vulnerabilities, you should upgrade your FreeRADIUS packages to the fixed version provided by the vendor.
Yes, you can enable the check_all_crl option in the EAP TLS section of the eap.conf file to prevent the acceptance of revoked client certificates.
No, servers that use self-signed CAs are unaffected by the vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for freeradius.
