PT-2019-5502 · Freeradius+3 · Freeradius+3
Eyal Ronen
+1
·
Publicado
2019-08-03
·
Atualizado
2024-06-15
·
CVE-2019-13456
CVSS v3.1
6.5
Média
| Vetor | AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
FreeRADIUS versions 3.0 through 3.0.19
Description
The issue is related to errors in EAP-pwd authentication, which can lead to information leakage. This leakage is similar to the "Dragonblood" attack and can be used by an attacker to recover the password of any user. On average, 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. An attacker can exploit this vulnerability to obtain a password for authorization in a Wi-Fi network.
Recommendations
For FreeRADIUS versions 3.0 through 3.0.19, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Side Channel Attack
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Centos
Freeradius
Red Hat
Suse