Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 547
Alerts This Week
Warning Icon 1 547

Gentoo: GLSA-201706-27 Normal: FreeRADIUS Remote Access Bypass

gentoo
Calendar Grey June 27, 2017
Scroller Gentoo Esm H88
Gentoo GLSA 202308-12 addresses vulnerabilities in OpenSSH enabling potential remote access exploits. Upgrade suggested.
A vulnerability in FreeRADIUS might allow remote attackers to bypass authentication.

Summary

It was discovered that the implementation of TTLS and PEAP in FreeRADIUS skips inner authentication when it handles a resumed TLS connection. The affected versions of FreeRADIUS fails to reliably prevent the resumption of unauthenticated sessions unless the TLS session cache is disabled completely.

Topics%20covered

Topics Covered

security advisory gentoo remote access authentication freeRADIUS bypass normal severity

Resolution

All FreeRADIUS users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-dialup/freeradius-3.0.14"

References

[ 1 ] CVE-2017-9148 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-9148

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201706-27
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: Normal
Title: FreeRADIUS: Security bypass
Date: June 27, 2017
Bugs: #620186
ID: 201706-27

Topics%20covered

Topics Covered

security advisory gentoo remote access authentication freeRADIUS bypass normal severity

Synopsis

A vulnerability in FreeRADIUS might allow remote attackers to bypass authentication.

Background

FreeRADIUS is an open source RADIUS authentication server.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-dialup/freeradius < 3.0.14 >= 3.0.14

Impact

===== An unauthenticated remote user can bypass authentication by starting a session, and then resuming an unauthenticated TLS session before inner authentication has been completed successfully.

Workaround

Set "enabled = no" in the cache subsection of eap module settings to disable TLS session caching.