Debian DSA-2546-1 : freeradius - stack-based buffer overflows

Timo Warns discovered that the EAP-TLS handling of FreeRADIUS, a high-performance and highly configurable RADIUS server, is not properly performing length checks on user-supplied input before copying to a local stack buffer. As a result, an unauthenticated attacker can exploit this flaw to crash...

FreeBSD : freeradius -- arbitrary code execution for TLS-based authentication (3bbbe3aa-fbeb-11e1-8bd8-0022156e8794)

freeRADIUS security team reports : Overflow in EAP-TLS for 2.1.10, 2.1.11 and 2.1.12. The issue was found by Timo Warns, and communicated to [email protected]. A sample exploit for the issue was included in the notification. The vulnerability was created in commit a368a6f4f4aaf on August 18...

[SECURITY] [DSA 2546-1] freeradius security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2546-1 [email protected] http://www.debian.org/security/ Nico Golde September 11, 2012 http://www.debian.org/security/faq -...

DSA-2546-1 freeradius - code execution

Bulletin has no description...

freeradius -- arbitrary code execution for TLS-based authentication

freeRADIUS security team reports: Overflow in EAP-TLS for 2.1.10, 2.1.11 and 2.1.12. The issue was found by Timo Warns, and communicated to [email protected]. A sample exploit for the issue was included in the notification. The vulnerability was created in commit a368a6f4f4aaf on August 18,...

Aruba Networks multiple advisories: OS command injection in RAP web interface and 802.1X EAP-TLS user authentication bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ADVISORY NUMBER 031912 Advisory 1: TITLE OS Command Injection Vulnerability in Aruba Remote Access Point Diagnostic Web Interface. SUMMARY An OS command injection vulnerability has been discovered in the Aruba Remote Access Point's Diagnostic Web...

SuSE 11.1 Security Update : NetworkManager-gnome (SAT Patch Number 5621)

NetworkManager did not pin a certificate's subject to an ESSID. A rogue access point could therefore be used to conduct MITM attacks by using any other valid certificate issued by same CA as used in the original network. CVE-2006-7246 Please note that existing WPA2 Enterprise connections need to ...

CVE-2011-2701

The ocspcheck function in rlmeaptls.c in FreeRADIUS 2.1.11, when OCSP is enabled, does not properly parse replies from OCSP responders, which allows remote attackers to bypass authentication by using the EAP-TLS protocol with a revoked X.509 client certificate...

Authentication flaw

The ocspcheck function in rlmeaptls.c in FreeRADIUS 2.1.11, when OCSP is enabled, does not properly parse replies from OCSP responders, which allows remote attackers to bypass authentication by using the EAP-TLS protocol with a revoked X.509 client certificate...

CVE-2011-2701

The ocspcheck function in rlmeaptls.c in FreeRADIUS 2.1.11, when OCSP is enabled, does not properly parse replies from OCSP responders, which allows remote attackers to bypass authentication by using the EAP-TLS protocol with a revoked X.509 client certificate...

CVE-2011-2701

The ocspcheck function in rlmeaptls.c in FreeRADIUS 2.1.11, when OCSP is enabled, does not properly parse replies from OCSP responders, which allows remote attackers to bypass authentication by using the EAP-TLS protocol with a revoked X.509 client certificate...

CVE-2011-2701

The CVE-2011-2701 issue affects FreeRADIUS 2.1.11 where the OCSP check in rlm_eap_tls.c mishandles OCSP replies when OCSP is enabled, enabling a remote attacker to bypass authentication in EAP-TLS using a revoked X.509 client certificate. Public disclosures across advisories (Mandriva MDVSA-2012:...

CVE-2011-2701

The ocspcheck function in rlmeaptls.c in FreeRADIUS 2.1.11, when OCSP is enabled, does not properly parse replies from OCSP responders, which allows remote attackers to bypass authentication by using the EAP-TLS protocol with a revoked X.509 client certificate...

[DSB-2011-01] Security Advisory FreeRADIUS 2.1.11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 DFN-CERT Services GmbH - Security Advisory ========================================== Advisory: DSB-2011-01 Version: 1.0 Released on: 2011-07-22 Updated on: 2011-07-22 Product: FreeRADIUS 2.1.11 2011-06-29 Summary - ------- FreeRADIUS is a RADIUS serv...

Aruba Mobility Controller - multiple advisories: DoS and authentication bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ADVISORY NUMBER 013111 Advisory 1: TITLE Malformed 802.11 Probe Request frame causes Denial of Service condition on an Access Point. SUMMARY A Denial of Service DoS vulnerability was discovered during standard bug reporting procedures. A malformed...

StrongSwan v4.5.0 - New Version

Our first post regarding strongSwan can be found here. Now, an update has been released – strongSwan v4.5.0. "strongSwan is an OpenSource IPsec implementation for the Linux operating system. It is based on the discontinued FreeS/WAN project and the X.509 patch which we developped over the last...

Default configuration

The default configuration of the FreeRADIUS server in Apple Mac OS X Server before 10.6.3 permits EAP-TLS authenticated connections on the basis of an arbitrary client certificate, which allows remote attackers to obtain network connectivity via a crafted RADIUS Access Request message...

CVE-2010-0524

CVE-2010-0524 affects the FreeRADIUS server in Apple Mac OS X Server prior to 10.6.3. The default configuration permits EAP-TLS authenticated connections based on an arbitrary client certificate, enabling a remote attacker to obtain network connectivity via a crafted RADIUS Access Request. Remedi...

CVE-2010-0524

The default configuration of the FreeRADIUS server in Apple Mac OS X Server before 10.6.3 permits EAP-TLS authenticated connections on the basis of an arbitrary client certificate, which allows remote attackers to obtain network connectivity via a crafted RADIUS Access Request message...

Juniper SBR V 6.0.1 CRL-Checking problem

We tried to setup crl-checking on den sbr v 6.0.1 Steel Belted RADIUS. The URL socket is located on the RSA Authenticationsever V 6.7. Radius authentication via EAP TLS should not work because the SBR got a "CRL Fetch: HTTP socket connect failure from one of...