Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long "not after" timestamp in a client certificate.

This update of freeradius fixes a stack overflow in TLS handling, which can be exploited by remote attackers able to access Radius to execute code.

The remote host is affected by the vulnerability described in GLSA-201311-09 (FreeRADIUS: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FreeRADIUS. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Mac OS X host has a version of OS X Server installed that is prior to 3.0. It is, therefore, affected by the following vulnerabilities :

  - A denial of service vulnerability exists in the     included JSON Ruby Gem, which can be abused to exhaust     all available memory resources. (CVE-2013-0269)

  - Multiple cross-site scripting vulnerabilities exist in     the included Ruby on Rails software. (CVE-2013-1854 /     CVE-2013-1855 / CVE-2013-1856 / CVE-2013-1857)

  - A buffer overflow exists in the included FreeRADIUS     software that can be triggered when parsing the 'not     after' timestamp in a client certificate when using     TLS-based EAP methods. (CVE-2012-3547)

  - A logic issue exists whereby the RADIUS service could     choose an incorrect certificate from a list of     configured certificates.

A buffer overflow flaw was discovered in the way radiusd handled the expiration date field in X.509 client certificates. A remote attacker could possibly use this flaw to crash radiusd if it were configured to use the certificate or TLS tunnelled authentication methods (such as EAP-TLS, EAP-TTLS, and PEAP). (CVE-2012-3547)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-1327 advisory.

    [2.1.12-4]
    - resolves: bug#855315       CVE-2012-3547 freeradius: Stack-based buffer overflow by processing       certain expiration date fields of a certificate during x509 certificate       validation

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-1326 advisory.

    [2.1.12-4]
    - resolves: bug#855316       CVE-2012-3547 freeradius: Stack-based buffer overflow by processing       certain expiration date fields of a certificate during x509 certificate       validation

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated freeradius packages fixes security vulnerabilities :

It was found that the unix module ignored the password expiration setting in /etc/shadow. If FreeRADIUS was configured to use this module for user authentication, this flaw could allow users with an expired password to successfully authenticate, even though their access should have been denied (CVE-2011-4966).

Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long not after timestamp in a client certificate (CVE-2012-3547).

This updates to the current upstream 2.2.0 release which is configuration compatible with the prior 2.1.12.

Version 2.2.0 includes a security fix for CVE-2012-3547 Stack-based buffer overflow

This update also includes a fix to prevent .rpmsave and .rpmnew files from being read from the configuration directories.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.

A buffer overflow flaw was discovered in the way radiusd handled the expiration date field in X.509 client certificates. A remote attacker could possibly use this flaw to crash radiusd if it were configured to use the certificate or TLS tunnelled authentication methods (such as EAP-TLS, EAP-TTLS, and PEAP). (CVE-2012-3547)

Users of FreeRADIUS are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, radiusd will be restarted automatically.

A vulnerability has been found and corrected in freeradius :

Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long not after timestamp in a client certificate (CVE-2012-3547).

The updated packages have been patched to correct this issue.

Updated freeradius2 packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.

A buffer overflow flaw was discovered in the way radiusd handled the expiration date field in X.509 client certificates. A remote attacker could possibly use this flaw to crash radiusd if it were configured to use the certificate or TLS tunnelled authentication methods (such as EAP-TLS, EAP-TTLS, and PEAP). (CVE-2012-3547)

Red Hat would like to thank Timo Warns of PRESENSE Technologies GmbH for reporting this issue.

Users of FreeRADIUS are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, radiusd will be restarted automatically.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:1326 advisory.

    FreeRADIUS is a high-performance and highly configurable free Remote     Authentication Dial In User Service (RADIUS) server, designed to allow     centralized authentication and authorization for a network.

    A buffer overflow flaw was discovered in the way radiusd handled the     expiration date field in X.509 client certificates. A remote attacker could     possibly use this flaw to crash radiusd if it were configured to use the     certificate or TLS tunnelled authentication methods (such as EAP-TLS,     EAP-TTLS, and PEAP). (CVE-2012-3547)

    Red Hat would like to thank Timo Warns of PRESENSE Technologies GmbH for     reporting this issue.

    Users of FreeRADIUS are advised to upgrade to these updated packages, which     contain a backported patch to correct this issue. After installing the     update, radiusd will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated freeradius packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.

A buffer overflow flaw was discovered in the way radiusd handled the expiration date field in X.509 client certificates. A remote attacker could possibly use this flaw to crash radiusd if it were configured to use the certificate or TLS tunnelled authentication methods (such as EAP-TLS, EAP-TTLS, and PEAP). (CVE-2012-3547)

Red Hat would like to thank Timo Warns of PRESENSE Technologies GmbH for reporting this issue.

Users of FreeRADIUS are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, radiusd will be restarted automatically.

Timo Warns discovered that FreeRADIUS incorrectly handled certain long timestamps in client certificates. A remote attacker could exploit this flaw and cause the FreeRADIUS server to crash, resulting in a denial of service, or possibly execute arbitrary code.

The default compiler options for affected releases should reduce the vulnerability to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

freeRADIUS security team reports :

Overflow in EAP-TLS for 2.1.10, 2.1.11 and 2.1.12.

The issue was found by Timo Warns, and communicated to security@freeradius.org. A sample exploit for the issue was included in the notification.

The vulnerability was created in commit a368a6f4f4aaf on August 18, 2010. Vulnerable versions include 2.1.10, 2.1.11, and 2.1.12. Also anyone running the git 'master' branch after August 18, 2010 is vulnerable.

All sites using TLS-based EAP methods and the above versions are vulnerable. The only configuration change which can avoid the issue is to disable EAP-TLS, EAP-TTLS, and PEAP.

An external attacker can use this vulnerability to over-write the stack frame of the RADIUS server, and cause it to crash. In addition, more sophisticated attacks may gain additional privileges on the system running the RADIUS server.

This attack does not require local network access to the RADIUS server. It can be done by an attacker through a WiFi Access Point, so long as the Access Point is configured to use 802.1X authentication with the RADIUS server.

Timo Warns discovered that the EAP-TLS handling of FreeRADIUS, a high-performance and highly configurable RADIUS server, is not properly performing length checks on user-supplied input before copying to a local stack buffer. As a result, an unauthenticated attacker can exploit this flaw to crash the daemon or execute arbitrary code via crafted certificates.

ID	Name	Product	Family	Severity
74758	openSUSE Security Update : freeradius (openSUSE-SU-2012:1200-1)	Nessus	SuSE Local Security Checks	medium
70869	GLSA-201311-09 : FreeRADIUS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
70590	Mac OS X : OS X Server < 3.0 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
69621	Amazon Linux AMI : freeradius (ALAS-2012-131)	Nessus	Amazon Linux Local Security Checks	medium
68634	Oracle Linux 5 : freeradius2 (ELSA-2012-1327)	Nessus	Oracle Linux Local Security Checks	critical
68633	Oracle Linux 6 : freeradius (ELSA-2012-1326)	Nessus	Oracle Linux Local Security Checks	critical
66052	Mandriva Linux Security Advisory : freeradius (MDVSA-2013:038)	Nessus	Mandriva Local Security Checks	medium
62603	Fedora 16 : freeradius-2.2.0-0.fc16 (2012-15743)	Nessus	Fedora Local Security Checks	medium
62427	Scientific Linux Security Update : freeradius on SL6.x i386/x86_64 (20121002)	Nessus	Scientific Linux Local Security Checks	medium
62426	Scientific Linux Security Update : freeradius2 on SL5.x i386/x86_64 (20121002)	Nessus	Scientific Linux Local Security Checks	medium
62425	Mandriva Linux Security Advisory : freeradius (MDVSA-2012:159)	Nessus	Mandriva Local Security Checks	medium
62407	RHEL 5 : freeradius2 (RHSA-2012:1327)	Nessus	Red Hat Local Security Checks	medium
62406	RHEL 6 : freeradius (RHSA-2012:1326)	Nessus	Red Hat Local Security Checks	critical
62396	CentOS 5 : freeradius2 (CESA-2012:1327)	Nessus	CentOS Local Security Checks	medium
62395	CentOS 6 : freeradius (CESA-2012:1326)	Nessus	CentOS Local Security Checks	medium
62348	Ubuntu 11.04 / 11.10 / 12.04 LTS : freeradius vulnerability (USN-1585-1)	Nessus	Ubuntu Local Security Checks	medium
62054	FreeBSD : freeradius -- arbitrary code execution for TLS-based authentication (3bbbe3aa-fbeb-11e1-8bd8-0022156e8794)	Nessus	FreeBSD Local Security Checks	medium
62049	Debian DSA-2546-1 : freeradius - stack-based buffer overflows	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2012-3547

critical

Tenable Plugins

medium

medium

high

medium

critical

critical

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium