CVE-2019-13456

In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This information leakage is...

Fedora 30 : freeradius (2019-17ed521527)

Security fix for CVE-2019-13456 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

Fedora 31 : freeradius (2019-ca0f5e835d)

Security fix for CVE-2019-13456 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

[SECURITY] Fedora 30 Update: freeradius-3.0.20-1.fc30

The FreeRADIUS Server Project is a high performance and highly configurable GPL'd free RADIUS server. The server is similar in some respects to Livingston's 2.0 server. While FreeRADIUS started as a variant of the Cistron RADIUS server, they don't share a lot in common any more. It now has many...

[SECURITY] Fedora 31 Update: freeradius-3.0.20-1.fc31

The FreeRADIUS Server Project is a high performance and highly configurable GPL'd free RADIUS server. The server is similar in some respects to Livingston's 2.0 server. While FreeRADIUS started as a variant of the Cistron RADIUS server, they don't share a lot in common any more. It now has many...

Unspecified Vulnerability in FreeRADIUS

FreeRADIUS is a set of software that implements the RADIUS protocol from the FreeRADIUS Server project. The software is mainly used for account authentication management, bookkeeping management and Internet account management. A security vulnerability exists in FreeRADIUS that can be exploited by...

FreeRadius 3.0.19 Logrotate Privilege Escalation Vulnerability

Privilege Escalation via Logrotate in FreeRadius Overview Identifier: AIT-SA-20191112-01 Target: FreeRadius Vendor: FreeRadius Version: all versions including 3.0.19 Fixed in Version: 12.2.3, 12.1.8 and 12.0.8 CVE: https://nvd.nist.gov/vuln/detail/CVE-2019-10143 Author: Wolfgang Hotwagner AIT...

FreeRadius 3.0.19 Logrotate Privilege Escalation

Privilege Escalation via Logrotate in FreeRadius Overview Identifier: AIT-SA-20191112-01 Target: FreeRadius Vendor: FreeRadius Version: all versions including 3.0.19 Fixed in Version: 12.2.3, 12.1.8 and 12.0.8 CVE: https://nvd.nist.gov/vuln/detail/CVE-2019-10143 Accessibility: Local Severity: Low...

freeradius:3.0 security and bug fix update

...

RHEL 8 : freeradius:3.0 (RHSA-2019:3353)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3353 advisory. FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service RADIUS server, designed to allow centralized...

Moderate: Red Hat Security Advisory: freeradius:3.0 security and bug fix update

An update for the freeradius:3.0 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

freeradius: privilege escalation due to insecure logrotate configuration

It was discovered freeradius does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user...

CVE-2019-18667

/usr/local/www/freeradiusviewconfig.php in the freeradius3 package before 0.15.73 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute arbitrary javascript code on a victim browser...

CVE-2019-18667

CVE-2019-18667 affects pfSense deployments using the freeradius3 package on FreeBSD. The vulnerability is in /usr/local/www/freeradius_view_config.php and arises from insufficient input validation, enabling a user-supplied XSS payload in password or username fields to execute arbitrary JavaScript...

CVE-2017-10983

An out-of-bounds read flaw was found in the way FreeRADIUS server handled decoding of DHCP packets. A remote attacker could use this flaw to crash the FreeRADIUS server by sending a specially crafted DHCP request...

EulerOS 2.0 SP3 : freeradius (EulerOS-SA-2019-2065)

According to the version of the freeradius package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was discovered freeradius does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to...

Fedora Update for freeradius FEDORA-2019-9454ce61b2

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 29 Update: freeradius-3.0.19-3.fc29

The FreeRADIUS Server Project is a high performance and highly configurable GPL'd free RADIUS server. The server is similar in some respects to Livingston's 2.0 server. While FreeRADIUS started as a variant of the Cistron RADIUS server, they don't share a lot in common any more. It now has many...

NewStart CGSL CORE 5.05 / MAIN 5.05 : freeradius Multiple Vulnerabilities (NS-SA-2019-0083)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has freeradius packages installed that are affected by multiple vulnerabilities: - FreeRADIUS before 3.0.19 mishandles the each participant verifies that the received scalar is within a range, and that the received group elemen...

NewStart CGSL CORE 5.04 / MAIN 5.04 : freeradius Multiple Vulnerabilities (NS-SA-2019-0079)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has freeradius packages installed that are affected by multiple vulnerabilities: - FreeRADIUS before 3.0.19 mishandles the each participant verifies that the received scalar is within a range, and that the received group elemen...