MGASA-2014-0088 Updated freeradius package fixes security vulnerability

SSHA processing in freeradius before 2.2.3 runs into a stack-based buffer overflow in the freeradius rlmpap module if the password source uses an unusually long hashed password CVE-2014-2015...

CVE-2014-2015

Stack-based buffer overflow in the normify function in the rlmpap module modules/rlmpap/rlmpap.c in FreeRADIUS 2.x, possibly 2.2.3 and earlier, and 3.x, possibly 3.0.1 and earlier, might allow attackers to cause a denial of service crash and possibly execute arbitrary code via a long password has...

FreeRADIUS: Multiple vulnerabilities

Background FreeRADIUS is an open source RADIUS authentication server. Description Multiple vulnerabilities have been discovered in FreeRADIUS. Please review the CVE identifiers referenced below for details. Impact A remote attacker could possibly execute arbitrary code with the privileges of the...

GLSA-201311-09 : FreeRADIUS: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201311-09 FreeRADIUS: Multiple vulnerabilities Multiple vulnerabilities have been discovered in FreeRADIUS. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrar...

Mac OS X : OS X Server < 3.0 Multiple Vulnerabilities

The remote Mac OS X host has a version of OS X Server installed that is prior to 3.0. It is, therefore, affected by the following vulnerabilities : - A denial of service vulnerability exists in the included JSON Ruby Gem, which can be abused to exhaust all available memory resources. CVE-2013-026...

Amazon Linux AMI : freeradius (ALAS-2012-131)

A buffer overflow flaw was discovered in the way radiusd handled the expiration date field in X.509 client certificates. A remote attacker could possibly use this flaw to crash radiusd if it were configured to use the certificate or TLS tunnelled authentication methods such as EAP-TLS, EAP-TTLS,...

Oracle Linux 5 : freeradius (ELSA-2009-1451)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2009-1451 advisory. 1.1.3-1.5 - Security: Fix Tunnel-Password zero-length attributes flaw bug 521912 Resolves: RH BZ522062 - rebase a couple of old patches...

Oracle Linux 5 : Moderate: / freeradius (ELSA-2007-0338)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2007-0338 advisory. 1.0.1-3.RHEL4.5 - fixed CVE-2007-2028: EAP-TTLS denial of service Resolves: rhbz236247 Tenable has extracted the preceding description block directly from the...

Oracle Linux 5 : freeradius2 (ELSA-2012-1327)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-1327 advisory. 2.1.12-4 - resolves: bug855315 CVE-2012-3547 freeradius: Stack-based buffer overflow by processing certain expiration date fields of a certificate during x509...

Oracle Linux 6 : freeradius (ELSA-2012-1326)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-1326 advisory. 2.1.12-4 - resolves: bug855316 CVE-2012-3547 freeradius: Stack-based buffer overflow by processing certain expiration date fields of a certificate during x509...

Mandriva Linux Security Advisory : freeradius (MDVSA-2013:038)

Updated freeradius packages fixes security vulnerabilities : It was found that the unix module ignored the password expiration setting in /etc/shadow. If FreeRADIUS was configured to use this module for user authentication, this flaw could allow users with an expired password to successfully...

CVE-2011-4966

modules/rlmunix/rlmunix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the password expiration in /etc/shadow, which allows remote authenticated users to authenticate using an expired password...

CVE-2011-4966

modules/rlmunix/rlmunix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the password expiration in /etc/shadow, which allows remote authenticated users to authenticate using an expired password...

Design/Logic Flaw

modules/rlmunix/rlmunix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the password expiration in /etc/shadow, which allows remote authenticated users to authenticate using an expired password...

CVE-2011-4966

CVE-2011-4966 affects FreeRADIUS prior to 2.2.0, where rlm_unix.c in unix authentication mode does not correctly check password expiration in /etc/shadow. This allows remote authenticated users to authenticate using an expired password. Connected advisories and patches reference a fix/patch for o...

CVE-2011-4966

modules/rlmunix/rlmunix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the password expiration in /etc/shadow, which allows remote authenticated users to authenticate using an expired password...

CVE-2011-4966

modules/rlmunix/rlmunix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the password expiration in /etc/shadow, which allows remote authenticated users to authenticate using an expired password...

CVE-2011-4966

modules/rlmunix/rlmunix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the password expiration in /etc/shadow, which allows remote authenticated users to authenticate using an expired password...

SuSE 11.2 Security Update : freeradius (SAT Patch Number 7255)

This update for freeradius-server provides the following fixes and improvements : - Increase the vendor IDs limit from 32767 to 65535. bnc791666 - Fix issues with escaping special characters in password. bnc797515 - Respect expired passwords and accounts when using the unix module. bnc797313,...

Scientific Linux Security Update : freeradius2 on SL5.x i386/x86_64 (20130108)

It was found that the 'unix' module ignored the password expiration setting in '/etc/shadow'. If FreeRADIUS was configured to use this module for user authentication, this flaw could allow users with an expired password to successfully authenticate, even though their access should have been denie...