CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41861 – freeradius: Crash on invalid abinary data
https://notcve.org/view.php?id=CVE-2022-41861
04 Jan 2023 — A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash. It was discovered that FreeRADIUS incorrectly handled multiple EAP-pwd handshakes. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS. • https://freeradius.org/security • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41860 – freeradius: Crash on unknown option in EAP-SIM
https://notcve.org/view.php?id=CVE-2022-41860
04 Jan 2023 — In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the server to crash. En freeradius, cuando un solicitante de EAP-SIM envía una opción SIM desconocida, el servidor intentará buscar esa opción en los diccionarios internos. Esta búsqueda fallará, pero el código SIM no verificará ese error. • https://freeradius.org/security • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-17185 – freeradius: eap-pwd: DoS issues due to multithreaded BN_CTX access
https://notcve.org/view.php?id=CVE-2019-17185
21 Mar 2020 — In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack. En FreeRADIUS versiones 3.0.x anteriores a 3.0.20, el módulo EAP-pwd utilizó una instancia OpenSSL BN_CTX global para manejar todos los protocolos de enlace. Esto significa que vari... • http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00039.html • CWE-567: Unsynchronized Access to Shared Data in a Multithreaded Context CWE-662: Improper Synchronization •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 2CVE-2019-13456 – freeradius: eap-pwd: Information leak due to aborting when needing more than 10 iterations
https://notcve.org/view.php?id=CVE-2019-13456
03 Dec 2019 — In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This information leakage is similar to the "Dragonblood" attack and CVE-2019-9494. En FreeRADIUS versiones 3.0 hasta 3.0.19, en promedio 1 de cada 2048 protocolos de enlace EAP-pwd presenta un fallo porque el elemento de contraseña no puede s... • http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00039.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-203: Observable Discrepancy •
CVSS: 7.0EPSS: 0%CPEs: 4EXPL: 3CVE-2019-10143 – freeradius: privilege escalation due to insecure logrotate configuration
https://notcve.org/view.php?id=CVE-2019-10143
24 May 2019 — It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user. NOTE: the upstream software maintainer has stated "there is simply no way for anyone to gain privileges through this alleged issue." ** EN DISPUTA **Se encontró que freeradius hasta la ... • https://packetstorm.news/files/id/155361 • CWE-250: Execution with Unnecessary Privileges CWE-266: Incorrect Privilege Assignment CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 9.8EPSS: 0%CPEs: 12EXPL: 0CVE-2019-11235 – freeradius: eap-pwd: authentication bypass via an invalid curve attack
https://notcve.org/view.php?id=CVE-2019-11235
21 Apr 2019 — FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499. FreeRADIUS versión anterior a 3.0.19 no maneja correctamente el mecanismo de protección "cada participante verifica que el escalar recibido está dentro de un rango, y que el elemento de grupo recibido es un punto válido en... • http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00014.html • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2019-11234 – freeradius: eap-pwd: fake authentication using reflection
https://notcve.org/view.php?id=CVE-2019-11234
21 Apr 2019 — FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497. FreeRADIUS antes de 3.0.19 no impide el uso de la reflexión para la autenticación de spoofing, también conocido como "Dragonblood", un problema similar al CVE-2019-9497. FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service server, designed to allow centralized authentication and authorization for a network. I... • http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00014.html • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 66%CPEs: 15EXPL: 0CVE-2017-10986 – freeradius: Infinite read in dhcp_attr2vp()
https://notcve.org/view.php?id=CVE-2017-10986
17 Jul 2017 — An FR-GV-303 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - Infinite read in dhcp_attr2vp()" and a denial of service. Un problema FR-GV-303 en FreeRADIUS versión 3.x anterior a 3.0.15, permite una "DHCP - Infinite read in dhcp_attr2vp()" y una denegación de servicio. An out-of-bounds read flaw was found in the way FreeRADIUS server handled decoding of DHCP packets. A remote attacker could use this flaw to crash the FreeRADIUS server by sending a specially crafted DHCP request. FreeRADIUS is a high-per... • http://freeradius.org/security/fuzzer-2017.html • CWE-125: Out-of-bounds Read CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.8EPSS: 0%CPEs: 15EXPL: 0CVE-2017-10985 – freeradius: Infinite loop and memory exhaustion with 'concat' attributes
https://notcve.org/view.php?id=CVE-2017-10985
17 Jul 2017 — An FR-GV-302 issue in FreeRADIUS 3.x before 3.0.15 allows "Infinite loop and memory exhaustion with 'concat' attributes" and a denial of service. Un problema FR-GV-302 en FreeRADIUS versión 3.x anterior a 3.0.15, permite un "Infinite loop and memory exhaustion with 'concat' attributes" y una denegación de servicio. A denial of service flaw was found in the way FreeRADIUS server handled certain attributes in request packets. A remote attacker could use this flaw to cause the FreeRADIUS server to enter an inf... • http://freeradius.org/security/fuzzer-2017.html • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.5EPSS: 0%CPEs: 15EXPL: 0CVE-2017-10987 – freeradius: Buffer over-read in fr_dhcp_decode_suboptions()
https://notcve.org/view.php?id=CVE-2017-10987
17 Jul 2017 — An FR-GV-304 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - Buffer over-read in fr_dhcp_decode_suboptions()" and a denial of service. Un problema FR-GV-304 en FreeRADIUS versión 3.x anterior a 3.0.15, permite una "DHCP - Buffer over-read in fr_dhcp_decode_suboptions()" y una denegación de servicio. An out-of-bounds read flaw was found in the way FreeRADIUS server handled decoding of DHCP packets. A remote attacker could use this flaw to crash the FreeRADIUS server by sending a specially crafted DHCP r... • http://freeradius.org/security/fuzzer-2017.html • CWE-125: Out-of-bounds Read •