FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - freeradius: the EAP-PWD module performs insufficient validation on packets received from an EAP peer     (CVE-2015-8764)

  - FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA     certificates. (CVE-2015-4680)

  - The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to cause a denial of service     (NULL pointer dereference and server crash) via a zero-length EAP-PWD packet. (CVE-2015-8762)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - freeradius: insufficent CRL application (CVE-2015-4680)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - freeradius: Out-of-bounds write in rad_coalesce() (CVE-2017-10979)

  - modules/rlm_unix/rlm_unix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication,     does not properly check the password expiration in /etc/shadow, which allows remote authenticated users to     authenticate using an expired password. (CVE-2011-4966)

  - FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA     certificates. (CVE-2015-4680)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for freeradius-server fixes the following issues :

  - CVE-2017-9148: Disable OpenSSL's internal session cache     to mitigate authentication bypass. (bnc#1041445)

  - CVE-2015-4680: Add a configuration option to allow     checking of all intermediate certificates for     revocations. (bnc#935573) The following non security     issue was fixed :

  - Cannot create table radpostauth because of deprecated     TIMESTAMP(14) syntax. (bsc#912873)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several issues were discovered in FreeRADIUS, a high-performance and highly configurable RADIUS server.

CVE-2014-2015

A stack-based buffer overflow was found in the normify function in the rlm_pap module, which can be attacked by existing users to cause denial of service or other issues.

CVE-2015-4680

It was discovered that freeradius failed to check revocation of intermediate CA certificates, thus accepting client certificates issued by revoked certificates from intermediate CAs.

Note that to enable checking of intermediate CA certificates, it is necessary to enable the check_all_crl option of the EAP TLS section in eap.conf. This is only necessary for servers using certificates signed by intermediate CAs. Servers that use self-signed CAs are unaffected.

CVE-2017-9148

The TLS session cache fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.

For Debian 7 'Wheezy', these problems have been fixed in version 2.1.12+dfsg-1.2+deb7u1.

We recommend that you upgrade your freeradius packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of freeradius-server fixes several issues. Security issue fixed :

  - CVE-2015-4680: Fixed Insufficent CRL application for     intermediate certificates (bsc#935573) Non security     issues fixed :

  - Allows FreeRadius Server to start on SUSE Linux     Enterprise Server 12 SP2 systems by relaxing a too     strict openssl version check. (bsc#1013311)

  - Fixed radclient error free() invalid pointer     (bsc#911886)

  - Fixed failing rebuild of freeradius-server package     (bsc#951404)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

oCERT reports :

The FreeRADIUS server relies on OpenSSL to perform certificate validation, including Certificate Revocation List (CRL) checks. The FreeRADIUS usage of OpenSSL, in CRL application, limits the checks to leaf certificates, therefore not detecting revocation of intermediate CA certificates.

An unexpired client certificate, issued by an intermediate CA with a revoked certificate, is therefore accepted by FreeRADIUS.

Specifically sets the X509_V_FLAG_CRL_CHECK flag for leaf certificate CRL checks, but does not use X509_V_FLAG_CRL_CHECK_ALL for CRL checks on the complete trust chain.

The FreeRADIUS project advises that the recommended configuration is to use self-signed CAs for all EAP-TLS methods.

ID	Name	Product	Family	Severity
198568	RHEL 7 : freeradius (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198532	RHEL 6 : freeradius (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198495	RHEL 5 : freeradius (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
101229	SUSE SLES11 Security Update : freeradius-server (SUSE-SU-2017:1777-1)	Nessus	SuSE Local Security Checks	critical
100623	Debian DLA-977-1 : freeradius security update	Nessus	Debian Local Security Checks	critical
96404	SUSE SLES12 Security Update : freeradius-server (SUSE-SU-2017:0102-1)	Nessus	SuSE Local Security Checks	high
84697	FreeBSD : freeradius -- insufficient CRL application vulnerability (379788f3-2900-11e5-a4a5-002590263bf5)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-4680

high

Tenable Plugins

high

high

critical

critical

critical

high

high