Stack-based buffer overflow in the normify function in the rlm_pap module (modules/rlm_pap/rlm_pap.c) in FreeRADIUS 2.x, possibly 2.2.3 and earlier, and 3.x, possibly 3.0.1 and earlier, might allow attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long password hash, as demonstrated by an SSHA hash.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - freeradius: stack-based buffer overflow flaw in rlm_pap module (CVE-2014-2015)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

Several issues were discovered in FreeRADIUS, a high-performance and highly configurable RADIUS server.

CVE-2014-2015

A stack-based buffer overflow was found in the normify function in the rlm_pap module, which can be attacked by existing users to cause denial of service or other issues.

CVE-2015-4680

It was discovered that freeradius failed to check revocation of intermediate CA certificates, thus accepting client certificates issued by revoked certificates from intermediate CAs.

Note that to enable checking of intermediate CA certificates, it is necessary to enable the check_all_crl option of the EAP TLS section in eap.conf. This is only necessary for servers using certificates signed by intermediate CAs. Servers that use self-signed CAs are unaffected.

CVE-2017-9148

The TLS session cache fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.

For Debian 7 'Wheezy', these problems have been fixed in version 2.1.12+dfsg-1.2+deb7u1.

We recommend that you upgrade your freeradius packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A stack-based buffer overflow was found in the way the FreeRADIUS rlm_pap module handled long password hashes. An attacker able to make radiusd process a malformed password hash could cause the daemon to crash.

A stack-based buffer overflow was found in the way the FreeRADIUS rlm_pap module handled long password hashes. An attacker able to make radiusd process a malformed password hash could cause the daemon to crash. (CVE-2014-2015)

The freeradius packages have been upgraded to upstream version 2.2.6, which provides a number of bug fixes and enhancements over the previous version, including :

  - The number of dictionaries have been updated.

  - This update implements several Extensible Authentication     Protocol (EAP) improvements.

  - A number of new expansions have been added, including:
    %{randstr:...}, %{hex:...}, %{sha1:...}, %{base64:...},     %{tobase64:...}, and %{base64tohex:...}.

  - Hexadecimal numbers (0x...) are now supported in     %{expr:...} expansions.

  - This update adds operator support to the rlm_python     module.

  - The Dynamic Host Configuration Protocol (DHCP) and DHCP     relay code have been finalized.

  - This update adds the rlm_cache module to cache arbitrary     attributes.

This update also fixes the following bugs :

  - The /var/log/radius/radutmp file was configured to     rotate at one-month intervals, even though this was     unnecessary. This update removes /var/log/radius/radutmp     from the installed logrotate utility configuration in     the /etc/logrotate.d/radiusd file, and     /var/log/radius/radutmp is no longer rotated.

  - The radiusd service could not write the output file     created by the raddebug utility. The raddebug utility     now sets appropriate ownership to the output file,     allowing radiusd to write the output.

  - After starting raddebug using the 'raddebug -t 0'     command, raddebug exited immediately. A typo in the     special case comparison has been fixed, and raddebug now     runs for 11.5 days in this situation.

  - MS-CHAP authentication failed when the User-Name and     MS-CHAP-User-Name attributes used different encodings,     even when the user provided correct credentials. Now,     MS-CHAP authentication properly handles mismatching     character encodings. Authentication with correct     credentials no longer fails in this situation.

  - Automatically generated default certificates used the     SHA-1 algorithm message digest, which is considered     insecure. The default certificates now use the more     secure SHA-256 algorithm message digest.

  - During the Online Certificate Status Protocol (OCSP)     validation, radiusd terminated unexpectedly with a     segmentation fault after attempting to access the next     update field that was not provided by the OCSP     responder. Now, radiusd does not crash in this situation     and instead continues to complete the OCSP validation.

  - Prior to this update, radiusd failed to work with some     of the more recent MikroTIK attributes, because the     installed directory.mikrotik file did not include them.
    This update adds MikroTIK attributes with IDs up to 22     to dictionary.mikrotik, and radiusd now works as     expected with these attributes.

After installing this update, the radiusd service will be restarted automatically.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-1287 advisory.

    [2.2.6-4]
    - Move OpenSSL init out of version check       Resolves: Bug#1189394 radiusd segfaults after update
    - Comment-out ippool-dhcp.conf inclusion       Resolves: Bug#1189386 radiusd fails to start after 'clean' installation

    [2.2.6-3]
    - Disable OpenSSL version check       Resolves: Bug#1189011

    [2.2.6-2]
    - Fix a number of new Coverity errors and compiler warnings.
      Resolves: Bug#1188598

    [2.2.6-1]
    - Upgrade to the latest upstream release v2.2.6       Resolves: Bug#921563  raddebug not working correctly       Resolves: Bug#921567  raddebug -t 0 exists immediately       Resolves: Bug#1060319 MSCHAP Authentication is not working using automatic                             windows user credentials       Resolves: Bug#1078736 Rebase FreeRADIUS to 2.2.4       Resolves: Bug#1135439 Default message digest defaults to sha1       Resolves: Bug#1142669 EAP-TLS and OCSP validation causing segmentation                             fault       Resolves: Bug#1173388 dictionary.mikrotik missing Attributes
    - Remove radutmp rotation       Resolves: Bug#904578  radutmp should not rotate
    - Check for start_servers not exceeding max_servers       Resolves: Bug#1146828 radiusd silently fails when start_servers is higher                             than max_servers

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated freeradius packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.

A stack-based buffer overflow was found in the way the FreeRADIUS rlm_pap module handled long password hashes. An attacker able to make radiusd process a malformed password hash could cause the daemon to crash. (CVE-2014-2015)

The freeradius packages have been upgraded to upstream version 2.2.6, which provides a number of bug fixes and enhancements over the previous version, including :

* The number of dictionaries have been updated.

* This update implements several Extensible Authentication Protocol (EAP) improvements.

* A number of new expansions have been added, including:
%{randstr:...}, %{hex:...}, %{sha1:...}, %{base64:...}, %{tobase64:...}, and %{base64tohex:...}.

* Hexadecimal numbers (0x...) are now supported in %{expr:...} expansions.

* This update adds operator support to the rlm_python module.

* The Dynamic Host Configuration Protocol (DHCP) and DHCP relay code have been finalized.

* This update adds the rlm_cache module to cache arbitrary attributes.

For a complete list of bug fixes and enhancements provided by this rebase, see the freeradius changelog linked to in the References section.

(BZ#1078736)

This update also fixes the following bugs :

* The /var/log/radius/radutmp file was configured to rotate at one-month intervals, even though this was unnecessary. This update removes /var/log/radius/radutmp from the installed logrotate utility configuration in the /etc/logrotate.d/radiusd file, and /var/log/radius/radutmp is no longer rotated. (BZ#904578)

* The radiusd service could not write the output file created by the raddebug utility. The raddebug utility now sets appropriate ownership to the output file, allowing radiusd to write the output. (BZ#921563)

* After starting raddebug using the 'raddebug -t 0' command, raddebug exited immediately. A typo in the special case comparison has been fixed, and raddebug now runs for 11.5 days in this situation.
(BZ#921567)

* MS-CHAP authentication failed when the User-Name and MS-CHAP-User-Name attributes used different encodings, even when the user provided correct credentials. Now, MS-CHAP authentication properly handles mismatching character encodings. Authentication with correct credentials no longer fails in this situation. (BZ#1060319)

* Automatically generated default certificates used the SHA-1 algorithm message digest, which is considered insecure. The default certificates now use the more secure SHA-256 algorithm message digest.
(BZ#1135439)

* During the Online Certificate Status Protocol (OCSP) validation, radiusd terminated unexpectedly with a segmentation fault after attempting to access the next update field that was not provided by the OCSP responder. Now, radiusd does not crash in this situation and instead continues to complete the OCSP validation. (BZ#1142669)

* Prior to this update, radiusd failed to work with some of the more recent MikroTIK attributes, because the installed directory.mikrotik file did not include them. This update adds MikroTIK attributes with IDs up to 22 to dictionary.mikrotik, and radiusd now works as expected with these attributes. (BZ#1173388)

Users of freeradius are advised to upgrade to these updated packages, which correct these issues and add these enhancements. After installing this update, the radiusd service will be restarted automatically.

The remote host is affected by the vulnerability described in GLSA-201406-12 (FreeRADIUS: Arbitrary code execution)

    Large passwords can trigger a stack-based buffer overflow in       FreeRADIUS&rsquo;s rlm_pap module when authenticating against an LDAP server.
  Impact :

    An authenticated user could set a specially crafted long password,       possibly leading to arbitrary code execution or a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

FreeRadius received a security fix :

A denial of service in rlm_pap hash processing was fixed (CVE-2014-2015 bnc#864576)

This update fixes a denial of service (crash) security issue rlm_pap hash processing in FreeRadius, which could have been caused by special passwords fed into the RLM-PAP password checking method via LDAP by remote attackers.

Updated freeradius package fixes security vulnerability :

SSHA processing in freeradius before 2.2.3 runs into a stack-based buffer overflow in the freeradius rlm_pap module if the password source uses an unusually long hashed password (CVE-2014-2015).

Fix stack-based buffer overflow flaw in rlm_pap module: long password hashes used by the PAP module can cause a buffer overflow which may terminate the server.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix stack-based buffer overflow flaw in rlm_pap module: long password hashes used by the PAP module can cause a buffer overflow which may terminate the server. fixes bug 1068795, string attributes passed to rlm_perl module were being truncated.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that FreeRADIUS incorrectly handled unix authentication. A remote user could successfully authenticate with an expired password. (CVE-2011-4966)

Pierre Carrier discovered that FreeRADIUS incorrectly handled rlm_pap hash processing. An authenticated user could use this issue to cause FreeRADIUS to crash, resulting in a denial of service, or possibly execute arbitrary code. The default compiler options for affected releases should reduce the vulnerability to a denial of service.
(CVE-2014-2015).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199284	RHEL 5 : freeradius2 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
100623	Debian DLA-977-1 : freeradius security update	Nessus	Debian Local Security Checks	critical
85454	Amazon Linux AMI : freeradius (ALAS-2015-581)	Nessus	Amazon Linux Local Security Checks	high
85192	Scientific Linux Security Update : freeradius on SL6.x i386/x86_64 (20150722)	Nessus	Scientific Linux Local Security Checks	high
85098	Oracle Linux 6 : freeradius (ELSA-2015-1287)	Nessus	Oracle Linux Local Security Checks	critical
85011	CentOS 6 : freeradius (CESA-2015:1287)	Nessus	CentOS Local Security Checks	high
84937	RHEL 6 : freeradius (RHSA-2015:1287)	Nessus	Red Hat Local Security Checks	high
76063	GLSA-201406-12 : FreeRADIUS: Arbitrary code execution	Nessus	Gentoo Local Security Checks	high
75280	openSUSE Security Update : freeradius-server (openSUSE-SU-2014:0343-1)	Nessus	SuSE Local Security Checks	high
73510	SuSE 11.3 Security Update : freeradius (SAT Patch Number 8968)	Nessus	SuSE Local Security Checks	high
73005	Mandriva Linux Security Advisory : freeradius (MDVSA-2014:058)	Nessus	Mandriva Local Security Checks	high
72888	Fedora 19 : freeradius-2.2.3-7.fc19 (2014-3192)	Nessus	Fedora Local Security Checks	high
72887	Fedora 20 : freeradius-3.0.1-4.fc20 (2014-3184)	Nessus	Fedora Local Security Checks	high
72719	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.10 : freeradius vulnerabilities (USN-2122-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2014-2015

critical

Tenable Plugins

critical

critical

high

high

critical

high

high

high

high

high

high

high

high

high