In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the server to crash.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2870 advisory.

    [3.0.20-14]
    - Fix defect found by Covscan       Resolves: #2151704

    [3.0.20-13]
    - Fix multiple CVEs
    - Add rpminspect configuration       Resolves: #2151702       Resolves: #2151704       Resolves: #2151706

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2870 advisory.

  - In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which     allows an attacker to substantially reduce the size of an offline dictionary attack. (CVE-2022-41859)

  - In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that     option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that     failure. Instead, it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

  - A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary     attribute which can cause the server to crash. (CVE-2022-41861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:2870 advisory.

  - In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which     allows an attacker to substantially reduce the size of an offline dictionary attack. (CVE-2022-41859)

  - In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that     option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that     failure. Instead, it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

  - A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary     attribute which can cause the server to crash. (CVE-2022-41861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2870 advisory.

    FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service     (RADIUS) server, designed to allow centralized authentication and authorization for a network.

    Security Fix(es):

    * freeradius: Information leakage in EAP-PWD (CVE-2022-41859)

    * freeradius: Crash on unknown option in EAP-SIM (CVE-2022-41860)

    * freeradius: Crash on invalid abinary data (CVE-2022-41861)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2166 advisory.

    [3.0.21-37]
    - Fix defect found by covscan       Resolves: #2151705

    [3.0.21-36]
    - Fix multiple CVEs       Resolves: #2151705       Resolves: #2151703       Resolves: #2151707

    [3.0.21-35]
    - Rebuild to add subpackages to CRB report       Resolves: #2126380

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2166 advisory.

  - In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which     allows an attacker to substantially reduce the size of an offline dictionary attack. (CVE-2022-41859)

  - In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that     option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that     failure. Instead, it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

  - A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary     attribute which can cause the server to crash. (CVE-2022-41861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2166 advisory.

    FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service     (RADIUS) server, designed to allow centralized authentication and authorization for a network.

    Security Fix(es):

    * freeradius: Information leakage in EAP-PWD (CVE-2022-41859)

    * freeradius: Crash on unknown option in EAP-SIM (CVE-2022-41860)

    * freeradius: Crash on invalid abinary data (CVE-2022-41861)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of freeradius installed on the remote host is prior to 2.2.6-7.17. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1699 advisory.

    When an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the     internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead,     it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of freeradius installed on the remote host is prior to 3.0.26-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1970 advisory.

    The EAP-PWD function compute_password_element() leaks information about the password which allows an     attacker to substantially reduce the size of an offline dictionary attack. (CVE-2022-41859)

    When an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the     internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead,     it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

    freeradius: A malicious RADIUS client or home server can send a malformed abinary attribute which can     cause the server to crash. (CVE-2022-41861)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3342 advisory.

  - In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which     allows an attacker to substantially reduce the size of an offline dictionary attack. (CVE-2022-41859)

  - In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that     option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that     failure. Instead, it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

  - A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary     attribute which can cause the server to crash. (CVE-2022-41861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the freeradius package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that     option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that     failure. Instead, it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

  - A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary     attribute which can cause the server to crash. (CVE-2022-41861)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0135-1 advisory.

  - In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which     allows an attacker to substantially reduce the size of an offline dictionary attack. (CVE-2022-41859)

  - In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that     option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that     failure. Instead, it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

  - A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary     attribute which can cause the server to crash. (CVE-2022-41861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0124-1 advisory.

  - In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which     allows an attacker to substantially reduce the size of an offline dictionary attack. (CVE-2022-41859)

  - In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that     option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that     failure. Instead, it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

  - A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary     attribute which can cause the server to crash. (CVE-2022-41861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5785-1 advisory.

    It was discovered that FreeRADIUS incorrectly handled multiple EAP-pwd handshakes. An attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS.
    (CVE-2019-17185)

    Shane Guan discovered that FreeRADIUS incorrectly handled memory when checking unknown SIM option sent by     EAP-SIM supplicant. An attacker could possibly use this issue to cause a denial of service on the server.
    This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-41860)

    It was discovered that FreeRADIUS incorrectly handled memory when processing certain abinary attributes.
    An attacker could possibly use this issue to cause a denial of service on the server. (CVE-2022-41861)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4626-1 advisory.

  - In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which     allows an attacker to substantially reduce the size of an offline dictionary attack. (CVE-2022-41859)

  - In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that     option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that     failure. Instead, it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

  - A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary     attribute which can cause the server to crash. (CVE-2022-41861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4622-1 advisory.

  - In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which     allows an attacker to substantially reduce the size of an offline dictionary attack. (CVE-2022-41859)

  - In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that     option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that     failure. Instead, it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

  - A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary     attribute which can cause the server to crash. (CVE-2022-41861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4620-1 advisory.

  - In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which     allows an attacker to substantially reduce the size of an offline dictionary attack. (CVE-2022-41859)

  - In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that     option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that     failure. Instead, it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

  - A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary     attribute which can cause the server to crash. (CVE-2022-41861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4621-1 advisory.

  - In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which     allows an attacker to substantially reduce the size of an offline dictionary attack. (CVE-2022-41859)

  - In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that     option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that     failure. Instead, it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

  - A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary     attribute which can cause the server to crash. (CVE-2022-41861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-98832b2cc2 advisory.

    Update to upstream release 3.0.26.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
195334	RHEL 6 : freeradius (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195328	RHEL 7 : freeradius (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
176272	Oracle Linux 8 : freeradius:3.0 (ELSA-2023-2870)	Nessus	Oracle Linux Local Security Checks	high
176174	AlmaLinux 8 : freeradius:3.0 (ALSA-2023:2870)	Nessus	Alma Linux Local Security Checks	high
175889	CentOS 8 : freeradius:3.0 (CESA-2023:2870)	Nessus	CentOS Local Security Checks	high
175861	RHEL 8 : freeradius:3.0 (RHSA-2023:2870)	Nessus	Red Hat Local Security Checks	high
175687	Oracle Linux 9 : freeradius (ELSA-2023-2166)	Nessus	Oracle Linux Local Security Checks	high
175647	AlmaLinux 9 : freeradius (ALSA-2023:2166)	Nessus	Alma Linux Local Security Checks	high
175410	RHEL 9 : freeradius (RHSA-2023:2166)	Nessus	Red Hat Local Security Checks	high
172188	Amazon Linux AMI : freeradius (ALAS-2023-1699)	Nessus	Amazon Linux Local Security Checks	high
172167	Amazon Linux 2 : freeradius (ALAS-2023-1970)	Nessus	Amazon Linux Local Security Checks	high
171904	Debian DLA-3342-1 : freeradius - LTS security update	Nessus	Debian Local Security Checks	high
171175	EulerOS 2.0 SP8 : freeradius (EulerOS-SA-2023-1312)	Nessus	Huawei Local Security Checks	high
170664	SUSE SLES12 Security Update : freeradius-server (SUSE-SU-2023:0135-1)	Nessus	SuSE Local Security Checks	high
170478	SUSE SLES12 Security Update : freeradius-server (SUSE-SU-2023:0124-1)	Nessus	SuSE Local Security Checks	high
169516	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : FreeRADIUS vulnerabilities (USN-5785-1)	Nessus	Ubuntu Local Security Checks	high
169354	SUSE SLES15 Security Update : freeradius-server (SUSE-SU-2022:4626-1)	Nessus	SuSE Local Security Checks	high
169352	SUSE SLES15 Security Update : freeradius-server (SUSE-SU-2022:4622-1)	Nessus	SuSE Local Security Checks	high
169349	SUSE SLES15 Security Update : freeradius-server (SUSE-SU-2022:4620-1)	Nessus	SuSE Local Security Checks	high
169348	SUSE SLES12 Security Update : freeradius-server (SUSE-SU-2022:4621-1)	Nessus	SuSE Local Security Checks	high
169161	Fedora 36 : freeradius (2022-98832b2cc2)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2022-41860

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high