PT-2004-3058 · Openbsd · Login Radius+1

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2163

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions login radius on OpenBSD versions 3.2, 3.5

Description The issue allows remote attackers to bypass authentication by spoofing server replies due to the lack of verification of the shared secret in response packets from a RADIUS server.

Recommendations For OpenBSD versions 3.2 and 3.5, consider disabling the login radius functionality until a patch is available to verify the shared secret in RADIUS server responses.

Fix

Related Identifiers

CVE-2004-2163

Affected Products

Openbsd

Login Radius

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2004-2163 · Security Note
• http://openbsd.org/errata35.html#radius · Patch
• http://securityfocus.com/bid/11227 · Patch
• http://reseau.nl/advisories/0400-openbsd-radius.txt · Vendor Advisory
• http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0058.html · Vendor Advisory
• http://secunia.com/advisories/12617 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17456 · Note
• http://osvdb.org/10203 · Note