freeradius: eap-pwd: fake authentication using reflection

FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497...

Important: Red Hat Security Advisory: freeradius security update

An update for freeradius is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

freeradius security update

3.0.13-10 - Fixes two EAP-PWD security issues Resolves: bz1699413 authentication bypass with an invalid curve attack...

openSUSE: Security Advisory for freeradius-server (openSUSE-SU-2019:1346-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE Security Update : freeradius-server (openSUSE-2019-1346)

This update for freeradius-server fixes the following issues : Security issues fixed : - CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points bsc1132549. - CVE-2019-11234: Fixed an authentication bypass caused by...

OPENSUSE-SU-2019:1346-1 Security update for freeradius-server

This update for freeradius-server fixes the following issues: Security issues fixed: - CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points bsc1132549. - CVE-2019-11234: Fixed an authentication bypass caused by...

SUSE SLES12 Security Update : freeradius-server (SUSE-SU-2019:1181-1)

This update for freeradius-server fixes the following issues : Security issues fixed : CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points bsc1132549. CVE-2019-11234: Fixed an authentication bypass caused by...

Security update for freeradius-server (important)

openSUSE Security Update: Security update for freeradius-server Announcement ID: openSUSE-SU-2019:1346-1 Rating: important References: 1132549 1132664 Cross-References: CVE-2019-11234 CVE-2019-11235 Affected Products: openSUSE Leap 15.0 An update that fixes two vulnerabilities is now available...

SUSE-SU-2019:1181-1 Security update for freeradius-server

This update for freeradius-server fixes the following issues: Security issues fixed: - CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points bsc1132549. - CVE-2019-11234: Fixed an authentication bypass caused by...

Fedora Update for freeradius FEDORA-2019-9667df8350

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Denial Of Service (DoS)

FreeRADIUS is vulnerable to denial of serviceDoS attacks. This is because it fails to properly handle certain attributes in request packets. A remote attacker could use this flaw to crash the FreeRADIUS server by sending a specially crafted request packet...

Denial Of Service (DoS)

FreeRADIUS is vulnerable to denial of serviceDoS attacks. A remote user can send specially crafted DHCP data to trigger a memory leak in decodetlv and consume excessive memory on the target system which leads to a crash due to memory exhaustion...

Denial Of Service (DoS)

FreeRADIUS is vulnerable to denial of serviceDoS attacks. A remote user can send specially crafted DHCP data to trigger a read overflow in frdhcpdecodeoptions and cause the application to crash...

Denial Of Service (DoS)

FreeRADIUS is vulnerable to denial of serviceDoS. A remote user can send specially crafted DHCP option 63 data to trigger a read overflow in frdhcpdecodeoptions and cause the application to crash...

Denial Of Service (DoS)

FreeRADIUS is vulnerable to denial of serviceDoS attacks. A remote user can send specially crafted DHCP data to trigger a memory leak in frdhcpdecode and consume excessive memory on the target system which leads application to crash due to memory exhaustion...

SUSE SLED15 / SLES15 Security Update : freeradius-server (SUSE-SU-2019:1086-1)

This update for freeradius-server fixes the following issues : Security issues fixed : CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points bsc1132549. CVE-2019-11234: Fixed an authentication bypass caused by...

SUSE-SU-2019:1086-1 Security update for freeradius-server

This update for freeradius-server fixes the following issues: Security issues fixed: - CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points bsc1132549. - CVE-2019-11234: Fixed an authentication bypass caused by...

SUSE SLES12 Security Update : freeradius-server (SUSE-SU-2019:1039-1)

This update for freeradius-server fixes the following issues : Security issues fixed : CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points bsc1132549. CVE-2019-11234: Fixed an authentication bypass caused by...

SUSE-SU-2019:1039-1 Security update for freeradius-server

This update for freeradius-server fixes the following issues: Security issues fixed: - CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points bsc1132549. - CVE-2019-11234: Fixed an authentication bypass caused by...

Ubuntu: Security Advisory (USN-3954-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...