NewStart CGSL CORE 5.05 / MAIN 5.05 : freeradius Multiple Vulnerabilities (NS-SA-2021-0151)

high Nessus Plugin ID 154528

Synopsis

The remote NewStart CGSL host is affected by multiple vulnerabilities.

Description

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has freeradius packages installed that are affected by multiple vulnerabilities:

- ** DISPUTED ** It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user. NOTE: the upstream software maintainer has stated there is simply no way for anyone to gain privileges through this alleged issue. (CVE-2019-10143)

- In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This information leakage is similar to the Dragonblood attack and CVE-2019-9494. (CVE-2019-13456)

- In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of- Service (DoS) attack. (CVE-2019-17185)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade the vulnerable CGSL freeradius packages. Note that updated packages may not be available yet. Please contact ZTE for more information.

See Also

http://security.gd-linux.com/info/CVE-2019-13456

http://security.gd-linux.com/info/CVE-2019-17185

http://security.gd-linux.com/notice/NS-SA-2021-0151

http://security.gd-linux.com/info/CVE-2019-10143

Plugin Details

Severity: High

ID: 154528

File Name: newstart_cgsl_NS-SA-2021-0151_freeradius.nasl

Version: 1.3

Type: local

Published: 10/27/2021

Updated: 10/28/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 6.9

Temporal Score: 5.4

Vector: CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2019-10143

CVSS v3

Risk Factor: High

Base Score: 7

Temporal Score: 6.3

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:zte:cgsl_main:freeradius-doc, p-cpe:/a:zte:cgsl_main:freeradius-krb5, p-cpe:/a:zte:cgsl_main:freeradius-ldap, p-cpe:/a:zte:cgsl_main:freeradius-mysql, p-cpe:/a:zte:cgsl_main:freeradius-perl, p-cpe:/a:zte:cgsl_main:freeradius-postgresql, p-cpe:/a:zte:cgsl_main:freeradius-python, p-cpe:/a:zte:cgsl_main:freeradius-sqlite, p-cpe:/a:zte:cgsl_main:freeradius-unixodbc, p-cpe:/a:zte:cgsl_main:freeradius-utils, cpe:/o:zte:cgsl_core:5, cpe:/o:zte:cgsl_main:5, p-cpe:/a:zte:cgsl_core:freeradius, p-cpe:/a:zte:cgsl_core:freeradius-devel, p-cpe:/a:zte:cgsl_core:freeradius-doc, p-cpe:/a:zte:cgsl_core:freeradius-krb5, p-cpe:/a:zte:cgsl_core:freeradius-ldap, p-cpe:/a:zte:cgsl_core:freeradius-mysql, p-cpe:/a:zte:cgsl_core:freeradius-perl, p-cpe:/a:zte:cgsl_core:freeradius-postgresql, p-cpe:/a:zte:cgsl_core:freeradius-python, p-cpe:/a:zte:cgsl_core:freeradius-sqlite, p-cpe:/a:zte:cgsl_core:freeradius-unixodbc, p-cpe:/a:zte:cgsl_core:freeradius-utils, p-cpe:/a:zte:cgsl_main:freeradius, p-cpe:/a:zte:cgsl_main:freeradius-devel

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/ZTE-CGSL/release, Host/ZTE-CGSL/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/24/2021

Vulnerability Publication Date: 5/9/2019

Reference Information

CVE: CVE-2019-10143, CVE-2019-13456, CVE-2019-17185