Ubuntu 22.04 LTS: USN-5785-1 High: FreeRADIUS Denial of Service

ubuntu

January 4, 2023

Several security issues were fixed in FreeRADIUS.

Summary

Several security issues were fixed in FreeRADIUS.

Software Description:

- freeradius: high-performance and highly configurable RADIUS server

Details:

It was discovered that FreeRADIUS incorrectly handled multiple EAP-pwd

handshakes. An attacker could possibly use this issue to cause a denial of

service. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-17185)

Shane Guan discovered that FreeRADIUS incorrectly handled memory when

checking unknown SIM option sent by EAP-SIM supplicant. An attacker could

possibly use this issue to cause a denial of service on the server. This

issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04

LTS. (CVE-2022-41860)

It was discovered that FreeRADIUS incorrectly handled memory when

processing certain abinary attributes. An attacker could possibly use this

issue to cause a denial of service on the server. (CVE-2022-41861)

Topics Covered

security advisory denial of service high severity security issue Ubuntu system update FreeRADIUS

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS:
  freeradius                      3.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu3.1

Ubuntu 20.04 LTS:
  freeradius                      3.0.20+dfsg-3ubuntu0.2

Ubuntu 18.04 LTS:
  freeradius                      3.0.16+dfsg-1ubuntu3.2

Ubuntu 16.04 ESM:
  freeradius                      2.2.8+dfsg-0.1ubuntu0.1+esm1

In general, a standard system update will make all the necessary changes.