CVE-2019-17185

Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA or Triple A) management for users who connect and use a network service.\r\n\r\n Security Fix(es):\r\n\r\n In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This information leakage is similar to the "Dragonblood" attack and CVE-2019-9494.(CVE-2019-13456)\r\n\r\n In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.(CVE-2019-17185)\r\n\r\n

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.

Security Fix(es):

• freeradius: eap-pwd: DoS issues due to multithreaded BN_CTX access (CVE-2019-17185)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.

In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.

Updated freeradius packages fix security vulnerabilities:

It was discovered freeradius does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user (CVE-2019-10143).

An information leak was discovered in the implementation of EAP-pwd in freeradius. An attacker could initiate several EAP-pwd handshakes to leak information, which can then be used to recover the user's WiFi password by performing dictionary and brute-force attacks (CVE-2019-13456).

Denial of service issues due to multithreaded BN_CTX access (CVE-2019-17185).

This update for freeradius-server fixes the following issues:

• CVE-2019-13456: Fixed a side-channel password leak in EAP-pwd (bsc#1144524).
• CVE-2019-17185: Fixed a debial of service due to multithreaded BN_CTX access (bsc#1166847).
• Fixed an issue in TLS-EAP where the OCSP verification, when an intermediate client certificate was not explicitly trusted (bsc#1146848).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the freeradius-server-3.0.23-1.5 package on the GA media of openSUSE Tumbleweed.

This update for freeradius-server fixes the following issues:

• CVE-2019-13456: Fixed a side-channel password leak in EAP-pwd (bsc#1144524).
• CVE-2019-17185: Fixed a debial of service due to multithreaded BN_CTX access (bsc#1166847).
• Fixed an issue in TLS-EAP where the OCSP verification, when an intermediate client certificate was not explicitly trusted (bsc#1146848).

This update for freeradius-server fixes the following issues:

• CVE-2019-13456: Fixed a side-channel password leak in EAP-pwd (bsc#1144524).
• CVE-2019-17185: Fixed a debial of service due to multithreaded BN_CTX access (bsc#1166847).

This update for freeradius-server fixes the following issues:

• CVE-2019-13456: Fixed a side-channel password leak in EAP-pwd (bsc#1144524).
• CVE-2019-17185: Fixed a debial of service due to multithreaded BN_CTX access (bsc#1166847).
• Fixed an issue in TLS-EAP where the OCSP verification, when an intermediate client certificate was not explicitly trusted (bsc#1146848).

This update for freeradius-server fixes the following issues:

• CVE-2019-13456: Fixed a side-channel password leak in EAP-pwd (bsc#1144524).
• CVE-2019-17185: Fixed a debial of service due to multithreaded BN_CTX access (bsc#1166847).

It was discovered that FreeRADIUS incorrectly handled multiple EAP-pwd handshakes. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-17185)

Shane Guan discovered that FreeRADIUS incorrectly handled memory when checking unknown SIM option sent by EAP-SIM supplicant. An attacker could possibly use this issue to cause a denial of service on the server. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-41860)

It was discovered that FreeRADIUS incorrectly handled memory when processing certain abinary attributes. An attacker could possibly use this issue to cause a denial of service on the server. (CVE-2022-41861)