The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.

According to the version of the freeradius package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The TLS session cache in FreeRADIUS 2.1.1 through     2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04,     and 4.0.x before 2017-02-04 fails to reliably prevent     resumption of an unauthenticated session, which allows     remote attackers (such as malicious 802.1X supplicants)     to bypass authentication via PEAP or     TTLS.(CVE-2017-9148)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Upgrade FreeRADIUS to upstream v3.0.14 release. The release includes fixes for various issues, including security issues, one of which is CVE-2017-9148.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for freeradius is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.

Security Fix(es) :

* An authentication bypass flaw was found in the way the EAP module in FreeRADIUS handled TLS session resumption. A remote unauthenticated attacker could potentially use this flaw to bypass the inner authentication check in FreeRADIUS by resuming an older unauthenticated TLS session. (CVE-2017-9148)

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for freeradius-server fixes the following issues :

  - CVE-2017-9148: Disable OpenSSL's internal session cache     to mitigate authentication bypass. (bnc#1041445)

  - CVE-2015-4680: Add a configuration option to allow     checking of all intermediate certificates for     revocations. (bnc#935573) The following non security     issue was fixed :

  - Cannot create table radpostauth because of deprecated     TIMESTAMP(14) syntax. (bsc#912873)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for freeradius is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.

Security Fix(es) :

* An authentication bypass flaw was found in the way the EAP module in FreeRADIUS handled TLS session resumption. A remote unauthenticated attacker could potentially use this flaw to bypass the inner authentication check in FreeRADIUS by resuming an older unauthenticated TLS session. (CVE-2017-9148)

Security Fix(es) :

  - An authentication bypass flaw was found in the way the     EAP module in FreeRADIUS handled TLS session resumption.
    A remote unauthenticated attacker could potentially use     this flaw to bypass the inner authentication check in     FreeRADIUS by resuming an older unauthenticated TLS     session. (CVE-2017-9148)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-1581 advisory.

    [3.0.4-8]
    - Disable internal OpenSSL cache and fix session cache file permissions.
      Resolves: Bug#1459131 CVE-2017-9148 freeradius: TLS resumption                             authentication bypass

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for freeradius-server fixes the following issues: Security issue fixed :

  - CVE-2017-9148: Disable OpenSSL's internal session cache     to mitigate authentication bypass. (bsc#1041445) Non     security issue fixed :

  - Fix case insensitive matching in compiled regular     expressions (bsc#1027243)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201706-27 (FreeRADIUS: Security bypass)

    It was discovered that the implementation of TTLS and PEAP in FreeRADIUS       skips inner authentication when it handles a resumed TLS connection. The       affected versions of FreeRADIUS fails to reliably prevent the resumption       of unauthenticated sessions unless the TLS session cache is disabled       completely.
  Impact :

    An unauthenticated remote user can bypass authentication by starting a       session, and then resuming an unauthenticated TLS session before inner       authentication has been completed successfully.
  Workaround :

    Set &ldquo;enabled = no&rdquo; in the cache subsection of eap module settings to       disable TLS session caching.

This update for freeradius-server fixes the following issues :

  - CVE-2017-9148: Disable OpenSSL's internal session cache     to mitigate authentication bypass. (boo#1041445)

Stefan Winter and Lubos Pavlicek discovered that FreeRADIUS incorrectly handled the TLS session cache. A remote attacker could possibly use this issue to bypass authentication by resuming an unauthenticated session.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several issues were discovered in FreeRADIUS, a high-performance and highly configurable RADIUS server.

CVE-2014-2015

A stack-based buffer overflow was found in the normify function in the rlm_pap module, which can be attacked by existing users to cause denial of service or other issues.

CVE-2015-4680

It was discovered that freeradius failed to check revocation of intermediate CA certificates, thus accepting client certificates issued by revoked certificates from intermediate CAs.

Note that to enable checking of intermediate CA certificates, it is necessary to enable the check_all_crl option of the EAP TLS section in eap.conf. This is only necessary for servers using certificates signed by intermediate CAs. Servers that use self-signed CAs are unaffected.

CVE-2017-9148

The TLS session cache fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.

For Debian 7 'Wheezy', these problems have been fixed in version 2.1.12+dfsg-1.2+deb7u1.

We recommend that you upgrade your freeradius packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Stefan Winter reports :

The TLS session cache in FreeRADIUS before 3.0.14 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.

ID	Name	Product	Family	Severity
102222	EulerOS 2.0 SP2 : freeradius (EulerOS-SA-2017-1135)	Nessus	Huawei Local Security Checks	critical
102221	EulerOS 2.0 SP1 : freeradius (EulerOS-SA-2017-1134)	Nessus	Huawei Local Security Checks	critical
101666	Fedora 26 : freeradius (2017-7ee5c17024)	Nessus	Fedora Local Security Checks	critical
101534	Virtuozzo 7 : freeradius / freeradius-devel / freeradius-doc / etc (VZLSA-2017-1581)	Nessus	Virtuozzo Local Security Checks	critical
101229	SUSE SLES11 Security Update : freeradius-server (SUSE-SU-2017:1777-1)	Nessus	SuSE Local Security Checks	critical
101119	CentOS 7 : freeradius (CESA-2017:1581)	Nessus	CentOS Local Security Checks	critical
101104	Scientific Linux Security Update : freeradius on SL7.x x86_64 (20170628)	Nessus	Scientific Linux Local Security Checks	critical
101097	Oracle Linux 7 : freeradius (ELSA-2017-1581)	Nessus	Oracle Linux Local Security Checks	critical
101081	SUSE SLES12 Security Update : freeradius-server (SUSE-SU-2017:1705-1)	Nessus	SuSE Local Security Checks	critical
101078	RHEL 7 : freeradius (RHSA-2017:1581)	Nessus	Red Hat Local Security Checks	critical
101073	GLSA-201706-27 : FreeRADIUS: Security bypass	Nessus	Gentoo Local Security Checks	critical
100882	openSUSE Security Update : freeradius-server (openSUSE-2017-709)	Nessus	SuSE Local Security Checks	critical
100735	Fedora 25 : freeradius (2017-e698bba980)	Nessus	Fedora Local Security Checks	critical
100678	Ubuntu 17.04 : freeradius vulnerability (USN-3316-1)	Nessus	Ubuntu Local Security Checks	critical
100623	Debian DLA-977-1 : freeradius security update	Nessus	Debian Local Security Checks	critical
100581	FreeBSD : FreeRADIUS -- TLS resumption authentication bypass (673dce46-46d0-11e7-a539-0050569f7e80)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2017-9148

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical