Unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass authentication or cause a denial of service (server crash) via "Insufficient input validation" in the EAP-MSCHAPv2 state machine module.

Several problems have been discovered in freeradius, a high-performance and highly configurable RADIUS server. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-4744     SuSE researchers have discovered several off-by-one     errors may allow remote attackers to cause a denial of     service and possibly execute arbitrary code.

  - CVE-2006-1354     Due to insufficient input validation it is possible for     a remote attacker to bypass authentication or cause a     denial of service.

Updated freeradius packages that fix an authentication weakness are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

FreeRADIUS is a high-performance and highly configurable free RADIUS server designed to allow centralized authentication and authorization for a network.

A bug was found in the way FreeRADIUS authenticates users via the MSCHAP V2 protocol. It is possible for a remote attacker to authenticate as a victim by sending a malformed MSCHAP V2 login request to the FreeRADIUS server. (CVE-2006-1354)

Please note that FreeRADIUS installations not using the MSCHAP V2 protocol for authentication are not vulnerable to this issue.

A bug was also found in the way FreeRADIUS logs SQL errors from the sql_unixodbc module. It may be possible for an attacker to cause FreeRADIUS to crash or execute arbitrary code if they are able to manipulate the SQL database FreeRADIUS is connecting to.
(CVE-2005-4744)

Users of FreeRADIUS should update to these erratum packages, which contain backported patches and are not vulnerable to these issues.

The freeradius development team reports :

A validation issue exists with the EAP-MSCHAPv2 module in all versions from 1.0.0 (where the module first appeared) to 1.1.0. Insufficient input validation was being done in the EAP-MSCHAPv2 state machine. A malicious attacker could manipulate their EAP-MSCHAPv2 client state machine to potentially convince the server to bypass authentication checks. This bypassing could also result in the server crashing

Freeradius Security Contact reports :

Insufficient input validation was being done in the EAP-MSCHAPv2 state machine. A malicious attacker could manipulate their EAP-MSCHAPv2 client state machine to potentially convince the server to bypass authentication checks. This bypassing could also result in the server crashing.

The remote host is affected by the vulnerability described in GLSA-200604-03 (FreeRADIUS: Authentication bypass in EAP-MSCHAPv2 module)

    FreeRADIUS suffers from insufficient input validation in the     EAP-MSCHAPv2 state machine.
  Impact :

    An attacker could cause the server to bypass authentication checks     by manipulating the EAP-MSCHAPv2 client state machine.
  Workaround :

    There is no known workaround at this time.

An unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass authentication or cause a denial of service (server crash) via 'Insufficient input validation' in the EAP-MSCHAPv2 state machine module.

Updated packages have been patched to correct this issue.

ID	Name	Product	Family	Severity
22631	Debian DSA-1089-1 : freeradius - several vulnerabilities	Nessus	Debian Local Security Checks	high
21895	CentOS 3 / 4 : freeradius (CESA-2006:0271)	Nessus	CentOS Local Security Checks	high
21678	FreeBSD : freeradius -- authentication bypass vulnerability (1a216dfd-f710-11da-9156-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	high
21412	FreeBSD : freeradius -- EAP-MSCHAPv2 Authentication Bypass (37a5c10f-bf56-11da-b0e9-00123ffe8333)	Nessus	FreeBSD Local Security Checks	high
21196	GLSA-200604-03 : FreeRADIUS: Authentication bypass in EAP-MSCHAPv2 module	Nessus	Gentoo Local Security Checks	high
21180	RHEL 3 / 4 : freeradius (RHSA-2006:0271)	Nessus	Red Hat Local Security Checks	high
21149	Mandrake Linux Security Advisory : freeradius (MDKSA-2006:060)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2006-1354

high

Tenable Plugins

high

high

high

high

high

high

high