In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2870 advisory.

  - A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary     attribute which can cause the server to crash. (CVE-2022-41861)

  - In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which     allows an attacker to substantially reduce the size of an offline dictionary attack. (CVE-2022-41859)

  - In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that     option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that     failure. Instead, it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2870 advisory.

  - In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which     allows an attacker to substantially reduce the size of an offline dictionary attack. (CVE-2022-41859)

  - In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that     option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that     failure. Instead, it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

  - A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary     attribute which can cause the server to crash. (CVE-2022-41861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:2870 advisory.

  - In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which     allows an attacker to substantially reduce the size of an offline dictionary attack. (CVE-2022-41859)

  - In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that     option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that     failure. Instead, it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

  - A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary     attribute which can cause the server to crash. (CVE-2022-41861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2870 advisory.

  - freeradius: Information leakage in EAP-PWD (CVE-2022-41859)

  - freeradius: Crash on unknown option in EAP-SIM (CVE-2022-41860)

  - freeradius: Crash on invalid abinary data (CVE-2022-41861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2166 advisory.

  - In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that     option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that     failure. Instead, it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

  - In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which     allows an attacker to substantially reduce the size of an offline dictionary attack. (CVE-2022-41859)

  - A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary     attribute which can cause the server to crash. (CVE-2022-41861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2166 advisory.

  - In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which     allows an attacker to substantially reduce the size of an offline dictionary attack. (CVE-2022-41859)

  - In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that     option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that     failure. Instead, it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

  - A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary     attribute which can cause the server to crash. (CVE-2022-41861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2166 advisory.

  - freeradius: Information leakage in EAP-PWD (CVE-2022-41859)

  - freeradius: Crash on unknown option in EAP-SIM (CVE-2022-41860)

  - freeradius: Crash on invalid abinary data (CVE-2022-41861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of freeradius installed on the remote host is prior to 3.0.26-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1970 advisory.

  - In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which     allows an attacker to substantially reduce the size of an offline dictionary attack. (CVE-2022-41859)

  - In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that     option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that     failure. Instead, it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

  - A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary     attribute which can cause the server to crash. (CVE-2022-41861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3342 advisory.

  - In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which     allows an attacker to substantially reduce the size of an offline dictionary attack. (CVE-2022-41859)

  - In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that     option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that     failure. Instead, it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

  - A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary     attribute which can cause the server to crash. (CVE-2022-41861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0135-1 advisory.

  - In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which     allows an attacker to substantially reduce the size of an offline dictionary attack. (CVE-2022-41859)

  - In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that     option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that     failure. Instead, it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

  - A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary     attribute which can cause the server to crash. (CVE-2022-41861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0124-1 advisory.

  - In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which     allows an attacker to substantially reduce the size of an offline dictionary attack. (CVE-2022-41859)

  - In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that     option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that     failure. Instead, it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

  - A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary     attribute which can cause the server to crash. (CVE-2022-41861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4626-1 advisory.

  - In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which     allows an attacker to substantially reduce the size of an offline dictionary attack. (CVE-2022-41859)

  - In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that     option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that     failure. Instead, it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

  - A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary     attribute which can cause the server to crash. (CVE-2022-41861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4622-1 advisory.

  - In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which     allows an attacker to substantially reduce the size of an offline dictionary attack. (CVE-2022-41859)

  - In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that     option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that     failure. Instead, it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

  - A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary     attribute which can cause the server to crash. (CVE-2022-41861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4620-1 advisory.

  - In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which     allows an attacker to substantially reduce the size of an offline dictionary attack. (CVE-2022-41859)

  - In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that     option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that     failure. Instead, it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

  - A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary     attribute which can cause the server to crash. (CVE-2022-41861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4621-1 advisory.

  - In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which     allows an attacker to substantially reduce the size of an offline dictionary attack. (CVE-2022-41859)

  - In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that     option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that     failure. Instead, it will dereference a NULL pointer, and cause the server to crash. (CVE-2022-41860)

  - A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary     attribute which can cause the server to crash. (CVE-2022-41861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-98832b2cc2 advisory.

  - Information leakage in EAP-PWD (CVE-2022-41859)

  - Crash on unknown option in EAP-SIM (CVE-2022-41860)

  - Crash on invalid abinary data (CVE-2022-41861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
176272	Oracle Linux 8 : freeradius:3.0 (ELSA-2023-2870)	Nessus	Oracle Linux Local Security Checks	high
176174	AlmaLinux 8 : freeradius:3.0 (ALSA-2023:2870)	Nessus	Alma Linux Local Security Checks	high
175889	CentOS 8 : freeradius:3.0 (CESA-2023:2870)	Nessus	CentOS Local Security Checks	high
175861	RHEL 8 : freeradius:3.0 (RHSA-2023:2870)	Nessus	Red Hat Local Security Checks	high
175687	Oracle Linux 9 : freeradius (ELSA-2023-2166)	Nessus	Oracle Linux Local Security Checks	high
175647	AlmaLinux 9 : freeradius (ALSA-2023:2166)	Nessus	Alma Linux Local Security Checks	high
175410	RHEL 9 : freeradius (RHSA-2023:2166)	Nessus	Red Hat Local Security Checks	high
172167	Amazon Linux 2 : freeradius (ALAS-2023-1970)	Nessus	Amazon Linux Local Security Checks	high
171904	Debian DLA-3342-1 : freeradius - LTS security update	Nessus	Debian Local Security Checks	high
170664	SUSE SLES12 Security Update : freeradius-server (SUSE-SU-2023:0135-1)	Nessus	SuSE Local Security Checks	high
170478	SUSE SLES12 Security Update : freeradius-server (SUSE-SU-2023:0124-1)	Nessus	SuSE Local Security Checks	high
169354	SUSE SLES15 Security Update : freeradius-server (SUSE-SU-2022:4626-1)	Nessus	SuSE Local Security Checks	high
169352	SUSE SLES15 Security Update : freeradius-server (SUSE-SU-2022:4622-1)	Nessus	SuSE Local Security Checks	high
169349	SUSE SLES15 Security Update : freeradius-server (SUSE-SU-2022:4620-1)	Nessus	SuSE Local Security Checks	high
169348	SUSE SLES12 Security Update : freeradius-server (SUSE-SU-2022:4621-1)	Nessus	SuSE Local Security Checks	high
169161	Fedora 36 : freeradius (2022-98832b2cc2)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2022-41859

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high