NewStart CGSL CORE 5.04 / MAIN 5.04 : freeradius Multiple Vulnerabilities (NS-SA-2019-0079)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has freeradius packages installed that are affected by multiple vulnerabilities: - FreeRADIUS before 3.0.19 mishandles the each participant verifies that the received scalar is within a range, and that the received group elemen...

Oracle Linux 8 : freeradius:3.0 (ELSA-2019-1142)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-1142 advisory. 3.0.17-4 - Fixes two EAP-PWD security issues Resolves: bz1699416 authentication bypass with an invalid curve attack Tenable has extracted the preceding...

CVE-2019-13456

An information leak was discovered in the implementation of EAP-pwd in freeradius. An attacker could initiate several EAP-pwd handshakes to leak information, which can then be used to recover the user's WiFi password by performing dictionary and brute-force attacks...

FreeRADIUS Information Disclosure Vulnerability

FreeRADIUS is a set of software that implements the RADIUS protocol from the FreeRADIUS Server project. The software is mainly used for account authentication management, bookkeeping management and Internet account management. An information disclosure vulnerability exists in EAP-pwd in FreeRADIU...

Researchers Discover New Ways to Hack WPA3 Protected WiFi Passwords

The same team of cybersecurity researchers who discovered several severe vulnerabilities, collectively dubbed as Dragonblood, in the newly launched WPA3 WiFi security standard few months ago has now uncovered two more flaws that could allow attackers to hack WiFi passwords. WPA, or WiFi Protected...

freeradius:3.0 security update

3.0.17-4 - Fixes two EAP-PWD security issues Resolves: bz1699416 authentication bypass with an invalid curve attack...

EulerOS 2.0 SP8 : freeradius (EulerOS-SA-2019-1763)

According to the version of the freeradius package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was discovered freeradius does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to...

EulerOS 2.0 SP2 : freeradius (EulerOS-SA-2019-1747)

According to the version of the freeradius package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was discovered freeradius does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to...

EulerOS 2.0 SP5 : freeradius (EulerOS-SA-2019-1674)

According to the version of the freeradius package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was discovered freeradius does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to...

Fedora Update for freeradius FEDORA-2019-4a8eeaf80e

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 30 Update: freeradius-3.0.19-3.fc30

The FreeRADIUS Server Project is a high performance and highly configurable GPL'd free RADIUS server. The server is similar in some respects to Livingston's 2.0 server. While FreeRADIUS started as a variant of the Cistron RADIUS server, they don't share a lot in common any more. It now has many...

Amazon Linux 2 : freeradius (ALAS-2019-1218)

FreeRADIUS mishandles the 'each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used' protection mechanism, aka a 'Dragonblood' issue, a similar issue to CVE-2019-9498 and CVE-2019-9499 .CVE-2019-11235...

Important: freeradius

Issue Overview: FreeRADIUS mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and...

EulerOS 2.0 SP3 : freeradius (EulerOS-SA-2019-1573)

According to the version of the freeradius package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - freeradius: eap-pwd: fake authentication using reflection CVE-2019-11234 Note that Tenable Network Security has extracted the preceding...

EulerOS 2.0 SP2 : freeradius (EulerOS-SA-2019-1572)

According to the version of the freeradius package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - freeradius: eap-pwd: fake authentication using reflection CVE-2019-11234 Note that Tenable Network Security has extracted the preceding...

EulerOS 2.0 SP5 : freeradius (EulerOS-SA-2019-1574)

According to the version of the freeradius package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - freeradius: eap-pwd: fake authentication using reflection CVE-2019-11234 Note that Tenable Network Security has extracted the preceding...

CVE-2019-10143

It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally...

DEBIAN-CVE-2019-10143

It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally...

CVE-2019-10143

It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally...

ALPINE-CVE-2019-10143

It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally...