PT-2013-1466 · Freeradius+3 · Freeradius+3

Publicado 2013-01-08 · Atualizado 2016-01-05 · CVE-2011-4966

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FreeRADIUS versions prior to 2.2.0

Description The issue concerns improper password expiration checks in /etc/shadow when unix mode is enabled for user authentication. This allows remote authenticated users to authenticate using an expired password.

Recommendations For versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue. As a temporary workaround, consider disabling unix mode for user authentication until a patch is available. Restrict access to the authentication module to minimize the risk of exploitation. Avoid using expired passwords in the affected authentication process until the issue is resolved.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

ALT-PU-2016-1003

AZL-7231

CVE-2011-4966

RHSA-2013:0134

RHSA-2013_0134

SUSE-SU-2013_0356-1

Produtos afetados

Alt Linux

Freeradius

Red Hat

Suse

Referências · 10

• https://github.com/alandekok/freeradius-server/commit/1b1ec5ce75e224bd1755650c18ccdaa6dc53e605 · Nota
• http://lists.opensuse.org/opensuse-updates/2013-01/msg00079.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-4966 · Nota de Segurança
• http://rhn.redhat.com/errata/RHBA-2012-0881.html · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4966 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2013-0134.html · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2013-01/msg00029.html · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2011-4966 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2011-4966 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-7231 · Aviso do Fabricante