Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 51

Export CSV
CVE-2010-3696

freeradius: DoS via certain DHCP requests

The fr_dhcp_decode function in lib/dhcp.c in FreeRADIUS 2.1.9, in certain non-default builds, does not properly handle the DHCP Relay Agent Information option, which allows remote attackers to cause a denial of service (infinite loop and daemon outage) via a packet that has more than one sub-option. NOTE: some of these details are obtained from third party information.

CVSS 2.0 · 4.3 Medium EPSS 1.6% KEV · Not listed
Vendors
Freeradius
Products
Freeradius
CVE-2012-3547

freeradius: stack-based buffer overflow via long expiration date fields in client X509 certificates

Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long "not after" timestamp in a client certificate.

CVSS 2.0 · 6.8 Medium EPSS 5.7% KEV · Not listed
Vendors
Freeradius Redhat
Products
Freeradius Enterprise Linux
CVE-2011-4966

freeradius: does not respect expired passwords when using the unix module

modules/rlm_unix/rlm_unix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the password expiration in /etc/shadow, which allows remote authenticated users to authenticate using an expired password.

CVSS 2.0 · 6.0 Medium EPSS 1.4% KEV · Not listed
Vendors
Freeradius Redhat
Products
Freeradius Enterprise Linux
CVE-2011-2701

freeradius: OCSP does not verify status of certificates

The ocsp_check function in rlm_eap_tls.c in FreeRADIUS 2.1.11, when OCSP is enabled, does not properly parse replies from OCSP responders, which allows remote attackers to bypass authentication by using the EAP-TLS protocol with a revoked X.509 client certificate.

CVSS 2.0 · 5.8 Medium EPSS 1.8% KEV · Not listed
Vendors
Freeradius
Products
Freeradius
CVE-2010-3697

freeradius: crash when processing requests queued for more than 30 seconds

The wait_for_child_to_die function in main/event.c in FreeRADIUS 2.1.x before 2.1.10, in certain circumstances involving long-term database outages, does not properly handle long queue times for requests, which allows remote attackers to cause a denial of service (daemon crash) by sending many requests.

CVSS 2.0 · 4.3 Medium EPSS 2.2% KEV · Not listed
Vendors
Freeradius
Products
Freeradius
CVE-2019-17185

freeradius: eap-pwd: DoS issues due to multithreaded BN_CTX access

In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Freeradius Opensuse Redhat
Products
Freeradius Leap Enterprise Linux
CVE-2019-13456

freeradius: eap-pwd: Information leak due to aborting when needing more than 10 iterations

In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This information leakage is similar to the "Dragonblood" attack and CVE-2019-9494.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Freeradius Linux Opensuse and 1 more
Products
Freeradius Linux Kernel Leap and 1 more
CVE-2019-11235

freeradius: eap-pwd: authentication bypass via an invalid curve attack

FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.

CVSS 3.0 · 9.8 Critical EPSS 3.6% KEV · Not listed
Vendors
Canonical Fedoraproject Freeradius and 2 more
Products
Ubuntu Linux Fedora Freeradius and 7 more
CVE-2019-10143

freeradius: privilege escalation due to insecure logrotate configuration

It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user. NOTE: the upstream software maintainer has stated "there is simply no way for anyone to gain privileges through this alleged issue."

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Freeradius Redhat
Products
Fedora Freeradius Enterprise Linux
CVE-2015-9542

pam_radius: buffer overflow in password field

add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a crafted password to an application (loading the pam_radius library) and crash it. Arbitrary code execution might be possible, depending on the application, C library, compiler, and other factors.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Canonical Debian Freeradius
Products
Ubuntu Linux Debian Linux Pam Radius