PT-2004-3058 · Openbsd · Login Radius+1

Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-2163

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions login radius on OpenBSD versions 3.2, 3.5

Description The issue allows remote attackers to bypass authentication by spoofing server replies due to the lack of verification of the shared secret in response packets from a RADIUS server.

Recommendations For OpenBSD versions 3.2 and 3.5, consider disabling the login radius functionality until a patch is available to verify the shared secret in RADIUS server responses.

Correção

Identificadores relacionados

CVE-2004-2163

Produtos afetados

Openbsd

Login Radius

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2004-2163 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17456 · Nota
• http://openbsd.org/errata35.html#radius · Correção
• http://securityfocus.com/bid/11227 · Correção
• http://reseau.nl/advisories/0400-openbsd-radius.txt · Aviso do Fabricante
• http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0058.html · Aviso do Fabricante
• http://osvdb.org/10203 · Nota
• http://secunia.com/advisories/12617 · Aviso do Fabricante