CVE-2006-1354

Unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass authentication or cause a denial of service server crash via "Insufficient input validation" in the EAP-MSCHAPv2 state machine module...

CVE-2006-1354

CVE-2006-1354 affects FreeRADIUS 1.0.0–1.1.0. The root cause is insufficient input validation in the EAP-MSCHAPv2 state machine, allowing a remote attacker over the network to bypass authentication or cause a denial of service (server crash). Connected OpenVAS entries and advisories corroborate t...

CVE-2006-1354

Unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass authentication or cause a denial of service server crash via "Insufficient input validation" in the EAP-MSCHAPv2 state machine module...

Vulnerability Notifications

2006.03.20 v1.0.5, and v1.1.0 - A validation issue exists with the EAP-MSCHAPv2 module in all versions from 1.0.0 where the module first appeared to 1.1.0. Insufficient input validation was being done in the EAP-MSCHAPv2 state machine. A malicious attacker could manipulate their EAP-MSCHAPv2 clie...

FreeRADIUS EAP authentication bypass and DoS

EAP-MSCHAPv2 implementation problems...

freeradius -- EAP-MSCHAPv2 Authentication Bypass

Freeradius Security Contact reports: Insufficient input validation was being done in the EAP-MSCHAPv2 state machine. A malicious attacker could manipulate their EAP-MSCHAPv2 client state machine to potentially convince the server to bypass authentication checks. This bypassing could also result i...

CVE-2004-1099

Cisco Secure Access Control Server for Windows ACS Windows and Cisco Secure Access Control Server Solution Engine ACS Solution Engine 3.3.1, when the EAP-TLS protocol is enabled, does not properly handle expired or untrusted certificates, which allows remote attackers to bypass authentication and...

CVE-2004-1099

Cisco Secure Access Control Server for Windows (ACS Windows) and Cisco Secure Access Control Server Solution Engine (ACS Solution Engine) 3.3.1 are affected when EAP-TLS is enabled. They do not properly handle expired or untrusted certificates, allowing remote attackers to bypass authentication a...

Cisco Secure ACS protection bypass

IF EAP-TLS is used validity of ceritifcation agency is not checked...

Cisco Security Advisory: Vulnerability in Cisco Secure Access Control Server EAP-TLS Authentication

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Vulnerability in Cisco Secure Access Control Server EAP-TLS Authentication Revision 1.0 For Public Release 2004 November 2 1500 UTC GMT - ---------------------------------------------------------------------- Contents Summary...

Vulnerability in Cisco Secure Access Control Server EAP-TLS Authentication

...

UPDATE: Cisco Security Notice: Dictionary Attack on Cisco LEAP Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Notice: Dictionary Attack on Cisco LEAP Vulnerability Revision 2.0 Last Updated 2004 April 12 1600 UTC GMT For Public Release 2003 August 03 1600 UTC GMT ---------------------------------------------------------------------- Contents...