Multiple vulnerabilities were discovered in Gentoo's systemd unit for FreeRADIUS which could lead to root privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dialup/freeradius | * | < 3.0.20-r1 | >= 3.0.20-r1 |
FreeRADIUS is a modular, high performance free RADIUS suite.
It was discovered that Gentoo’s FreeRADIUS systemd unit set permissions on an unsafe directory on start.
A local attacker could escalate privileges.
There is no known workaround at this time.
All FreeRADIUS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dialup/freeradius-3.0.20-r1"
A vulnerability in FreeRADIUS might allow remote attackers to bypass authentication.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dialup/freeradius | * | < 3.0.14 | >= 3.0.14 |
FreeRADIUS is an open source RADIUS authentication server.
It was discovered that the implementation of TTLS and PEAP in FreeRADIUS skips inner authentication when it handles a resumed TLS connection. The affected versions of FreeRADIUS fails to reliably prevent the resumption of unauthenticated sessions unless the TLS session cache is disabled completely.
An unauthenticated remote user can bypass authentication by starting a session, and then resuming an unauthenticated TLS session before inner authentication has been completed successfully.
Set “enabled = no” in the cache subsection of eap module settings to disable TLS session caching.
All FreeRADIUS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dialup/freeradius-3.0.14"
A vulnerability in FreeRADIUS can lead to arbitrary code execution or Denial of Service by authenticated users.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dialup/freeradius | * | < 2.2.5 | >= 2.2.5 |
FreeRADIUS is an open source RADIUS authentication server.
Large passwords can trigger a stack-based buffer overflow in FreeRADIUS’s rlm_pap module when authenticating against an LDAP server.
An authenticated user could set a specially crafted long password, possibly leading to arbitrary code execution or a Denial of Service condition.
There is no known workaround at this time.
All FreeRADIUS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dialup/freeradius-2.2.5"
Multiple vulnerabilities have been found in FreeRADIUS, the worst of which allow execution of arbitrary code or Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dialup/freeradius | * | < 2.2.0 | >= 2.2.0 |
FreeRADIUS is an open source RADIUS authentication server.
Multiple vulnerabilities have been discovered in FreeRADIUS. Please review the CVE identifiers referenced below for details.
A remote attacker could possibly execute arbitrary code with the privileges of the process or cause a Denial of Service condition.
There is no known workaround at this time.
All FreeRADIUS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dialup/freeradius-2.2.0"
A memory leak has been discovered in FreeRADIUS, possibly allowing for a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dialup/freeradius | * | < 1.1.6 | >= 1.1.6 |
FreeRADIUS is an open source RADIUS authentication server implementation.
The Coverity Scan project has discovered a memory leak within the handling of certain malformed Diameter format values inside an EAP-TTLS tunnel.
A remote attacker could send a large amount of specially crafted packets to a FreeRADIUS server using EAP-TTLS authentication and exhaust all memory, possibly resulting in a Denial of Service.
There is no known workaround at this time.
All FreeRADIUS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dialup/freeradius-1.1.6"
The EAP-MSCHAPv2 module of FreeRADIUS is affected by a validation issue which causes some authentication checks to be bypassed.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dialup/freeradius | * | < 1.1.1 | >= 1.1.1, < 1.0.0 |
FreeRADIUS is an open source RADIUS authentication server implementation.
FreeRADIUS suffers from insufficient input validation in the EAP-MSCHAPv2 state machine.
An attacker could cause the server to bypass authentication checks by manipulating the EAP-MSCHAPv2 client state machine.
There is no known workaround at this time.
All FreeRADIUS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dialup/freeradius-1.1.1"
The FreeRADIUS server is vulnerable to an SQL injection attack and a buffer overflow, possibly resulting in disclosure and modification of data and Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dialup/freeradius | * | < 1.0.2-r4 | >= 1.0.2-r4 |
FreeRADIUS is an open source RADIUS authentication server implementation.
Primoz Bratanic discovered that the sql_escape_func function of FreeRADIUS may be vulnerable to a buffer overflow (BID 13541). He also discovered that FreeRADIUS fails to sanitize user-input before using it in a SQL query, possibly allowing SQL command injection (BID 13540).
By supplying carefully crafted input, a malicious user could cause an SQL injection or a buffer overflow, possibly leading to the disclosure and the modification of sensitive data or Denial of Service by crashing the server.
There are no known workarounds at this time.
All FreeRADIUS users should upgrade to the latest available version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dialup/freeradius-1.0.2-r4"
Multiple Denial of Service vulnerabilities were found and fixed in FreeRADIUS.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dialup/freeradius | * | < 1.0.1 | >= 1.0.1 |
FreeRADIUS is an open source RADIUS authentication server implementation.
There are undisclosed defects in the way FreeRADIUS handles incorrect received packets.
A remote attacker could send specially-crafted packets to the FreeRADIUS server to deny service to other users by crashing the server.
There is no known workaround at this time.
All FreeRADIUS users should upgrade to the latest version:
# emerge sync # emerge -pv ">=net-dialup/freeradius-1.0.1" # emerge ">=net-dialup/freeradius-1.0.1"
FreeRADIUS is vulnerable to a heap exploit and a NULL pointer dereference vulnerability.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dialup/freeradius | * | <= 0.9.2 | >= 0.9.3 |
FreeRADIUS is a popular open source RADIUS server.
FreeRADIUS versions below 0.9.3 are vulnerable to a heap exploit, however, the attack code must be in the form of a valid RADIUS packet which limits the possible exploits.
Also corrected in the 0.9.3 release is another vulnerability which causes the RADIUS server to de-reference a NULL pointer and crash when an Access-Request packet with a Tunnel-Password is received.
A remote attacker could craft a RADIUS packet which would cause the RADIUS server to crash, or could possibly overflow the heap resulting in a system compromise.
There is no known workaround at this time.
Users are encouraged to perform an 'emerge sync' and upgrade the package to the latest available version - 0.9.3 is available in portage and is marked as stable.
# emerge sync # emerge -pv '>=net-dialup/freeradius-0.9.3' # emerge '>=net-dialup/freeradius-0.9.3' # emerge clean