PT-2011-4033 · Freeradius · Freeradius

Josh Bressers + 1 · Publicado 2011-08-04 · Atualizado 2018-10-09 · CVE-2011-2701

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions FreeRADIUS version 2.1.11

Description The issue concerns the ocsp check function in rlm eap tls.c, which does not properly parse replies from OCSP responders when OCSP is enabled. This allows remote attackers to bypass authentication by using the EAP-TLS protocol with a revoked X.509 client certificate.

Recommendations For FreeRADIUS version 2.1.11, consider disabling the ocsp check function or restricting the use of the EAP-TLS protocol until a patch is available. Additionally, restrict access to the affected module to minimize the risk of exploitation.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2011-2701

Produtos afetados

Freeradius

Referências · 12

• http://secunia.com/advisories/45425 · Aviso do Fabricante
• http://securityfocus.com/bid/48880 · Nota
• https://dfn-cert.de/informationen/Sicherheitsbulletins/dsb-2011-01.html · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=724815 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2011-2701 · Nota de Segurança
• http://openwall.com/lists/oss-security/2011/07/15/6 · Nota
• http://securityfocus.com/archive/1/518974/100/0/threaded · Nota
• http://openwall.com/lists/oss-security/2011/07/20/9 · Nota
• http://openwall.com/lists/oss-security/2011/07/18/2 · Nota
• http://securitytracker.com/id?1025833 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/68782 · Nota
• http://securityreason.com/securityalert/8325 · Nota