FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA     certificates. (CVE-2015-4680)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA
    certificates. (CVE-2015-4680)

This update for freeradius-server fixes the following issues :

  - CVE-2017-9148: Disable OpenSSL's internal session cache     to mitigate authentication bypass. (bnc#1041445)

  - CVE-2015-4680: Add a configuration option to allow     checking of all intermediate certificates for     revocations. (bnc#935573) The following non security     issue was fixed :

  - Cannot create table radpostauth because of deprecated     TIMESTAMP(14) syntax. (bsc#912873)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several issues were discovered in FreeRADIUS, a high-performance and highly configurable RADIUS server.

CVE-2014-2015

A stack-based buffer overflow was found in the normify function in the rlm_pap module, which can be attacked by existing users to cause denial of service or other issues.

CVE-2015-4680

It was discovered that freeradius failed to check revocation of intermediate CA certificates, thus accepting client certificates issued by revoked certificates from intermediate CAs.

Note that to enable checking of intermediate CA certificates, it is necessary to enable the check_all_crl option of the EAP TLS section in eap.conf. This is only necessary for servers using certificates signed by intermediate CAs. Servers that use self-signed CAs are unaffected.

CVE-2017-9148

The TLS session cache fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.

For Debian 7 'Wheezy', these problems have been fixed in version 2.1.12+dfsg-1.2+deb7u1.

We recommend that you upgrade your freeradius packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of freeradius-server fixes several issues. Security issue fixed :

  - CVE-2015-4680: Fixed Insufficent CRL application for     intermediate certificates (bsc#935573) Non security     issues fixed :

  - Allows FreeRadius Server to start on SUSE Linux     Enterprise Server 12 SP2 systems by relaxing a too     strict openssl version check. (bsc#1013311)

  - Fixed radclient error free() invalid pointer     (bsc#911886)

  - Fixed failing rebuild of freeradius-server package     (bsc#951404)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

oCERT reports :

The FreeRADIUS server relies on OpenSSL to perform certificate validation, including Certificate Revocation List (CRL) checks. The FreeRADIUS usage of OpenSSL, in CRL application, limits the checks to leaf certificates, therefore not detecting revocation of intermediate CA certificates.

An unexpired client certificate, issued by an intermediate CA with a revoked certificate, is therefore accepted by FreeRADIUS.

Specifically sets the X509_V_FLAG_CRL_CHECK flag for leaf certificate CRL checks, but does not use X509_V_FLAG_CRL_CHECK_ALL for CRL checks on the complete trust chain.

The FreeRADIUS project advises that the recommended configuration is to use self-signed CAs for all EAP-TLS methods.

ID	Name	Product	Family	Severity
218834	Linux Distros Unpatched Vulnerability : CVE-2015-4680	Nessus	Misc.	high
401143	Alpine: multiple freeradius packages: security update to 3.0.8-r6 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
401143	Alpine: multiple freeradius packages: security update to 3.0.8-r6 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
101229	SUSE SLES11 Security Update : freeradius-server (SUSE-SU-2017:1777-1)	Nessus	SuSE Local Security Checks	critical
100623	Debian DLA-977-1 : freeradius security update	Nessus	Debian Local Security Checks	critical
96404	SUSE SLES12 Security Update : freeradius-server (SUSE-SU-2017:0102-1)	Nessus	SuSE Local Security Checks	high
84697	FreeBSD : freeradius -- insufficient CRL application vulnerability (379788f3-2900-11e5-a4a5-002590263bf5)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-4680

high

Tenable Plugins

high

high

high

critical

critical

high

high