SUSE CVE-2017-13032

The RADIUS parser in tcpdump before 4.9.2 has a buffer over-read in print-radius.c:printattrstring...

SUSE CVE-2022-41861

A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash...

SUSE CVE-2022-41860

In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the server to crash...

JSA10544 - 2012-11 Security Bulletin: Steel-Belted Radius: Multiple OpenSSL Vulnerabilities

Problem OpenSSL software distributed with Steel-Belted Radius is vulnerable to CVE-2011-4619, and CVE-2011-4576. These may allow decrypting encrypted information or cause a denial of service condition for the Steel-Belted Radius server. CVE-2011-4576 The SSL 3.0 implementation in OpenSSL before...

JSA10398 - Security Vulnerability in Pulse Connect Secure Platforms) RADIUS authentication mechanism

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. This Security Advisory is an addendum to PSN 2008-05-007. Affected releases: 6.0R1; 6.0R2; 6.0R3; 6.0R3.1 6.1R1; 6.1R2; 6.1R3; 6.1R4, 6.1R5; 6.1R6 To download the latest software, plea...

JSA10569 - 2013-05 Security Bulletin: Steel Belted Radius: OpenSSL vulnerability CVE-2012-2110

Problem OpenSSL software provided with Steel-Belted Radius SBR Enterprise is vulnerable to CVE-2012-2110. This may allow code execution type of attacks using crafted certificates. Related Links Acknowledgements Risk Level High Risk Assessment Workaround There are no known workarounds that can...

JSA10379 - Security Vulnerability in Pulse Connect Secue (PCS) RADIUS authentication mechanism

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. If RADIUSis being used as the authentication mechanism on PCS running an affected release of the OS, then in a specific scenario, an unauthenticated user may be able to get past the...

JSA10385 - Certain crafted packets can crash Steel-Belted Radius or hijack the server machine.

Problem By sending crafted, invalid data to the TCP administration port 1813 by default or the TCP control port 1812 by default an attacker may be able to crash the SBR server process. An attacker may also be able to inject code that will run as root on the server machine. If firewalls or other...

JSA10410 - Steel-Belted Radius EAP-FAST Authentication Succeeds with Incorrect Password

Problem Certain SBR products are vulnerable to a condition in which the authentication phase Phase 1 of EAP-FAST can be bypassed. This may allow an attacker to gain unauthorized access without providing a password or token value. This is a Pulse Secure Security Advisory released to our entitled...

JSA10399 - Security Vulnerability in Pulse Policy Secure (PPS) software's radius authentication mechanism

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. This Security Advisory is an addendum to JSA10380.. The purpose is to notify customers of the removal of the affected releases from the Pulse Secure software download site. JSA10380 -...

JSA10380 - Security Vulnerability in Pulse Policy Secure Platform's Radius Authentication Server used in a Realm not doing Radius Proxy.

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. When using a Radius authentication server in a realm configured with the "Do Not Proxy" option, an unauthenticated user may bypass the authentication step of the PPS login process. A b...

Huawei EulerOS: Security Advisory for freeradius (EulerOS-SA-2023-1312)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP8 : freeradius (EulerOS-SA-2023-1312)

According to the versions of the freeradius package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionarie...

SUSE SLES12: freeradius-server / freeradius-server-doc / freeradius-server-krb5 / etc (SUSE-SU-2023:0135-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0135-1 advisory. - CVE-2022-41859: Fixed an issue in EAP-PWD that could leak information about the password, which could facilitate dictionary attacks bsc120620...

SUSE-SU-2023:0135-1 Security update for freeradius-server

This update for freeradius-server fixes the following issues: - CVE-2022-41859: Fixed an issue in EAP-PWD that could leak information about the password, which could facilitate dictionary attacks bsc1206204. - CVE-2022-41860: Fixed a crash in servers with EAPSIM manually configured, which could b...

SUSE SLES12: freeradius-server / freeradius-server-doc / freeradius-server-krb5 / etc (SUSE-SU-2023:0124-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0124-1 advisory. - CVE-2022-41859: Fixed an issue in EAP-PWD that could leak information about the password, which could facilitate dictionary attac...

CVE-2022-41861

A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash...

ALPINE-CVE-2022-41861

A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash...

AZL-13063 CVE-2022-41861 affecting package freeradius for versions less than 3.2.3-1

A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash...

Design/Logic Flaw

A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash...