PT-2019-11595 · Freeradius+4 · Freeradius+4

Published 2019-05-24 · Updated 2024-08-04 · CVE-2019-10143

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: freeradius versions up to and including 3.0.19

Description: The issue is related to the incorrect configuration of logrotate in freeradius, potentially allowing a local attacker who already has control of the radiusd user to escalate their privileges to root. This could be achieved by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user. However, the upstream software maintainer has disputed this claim, stating that there is no way for anyone to gain privileges through this alleged issue.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Race Condition

Incorrect Privilege Assignment

Weakness Enumeration

CWE-362

CWE-250

CWE-266

Related Identifiers

ALT-PU-2020-1496

CESA-2019_3353

CESA-2020_3984

CVE-2019-10143

MGASA-2020-0007

RHSA-2019:3353

RHSA-2019_3353

RHSA-2020:3984

RHSA-2020_3984

Affected Products

Alt Linux

Centos

Debian

Freeradius

Red Hat

References · 27

• 🔥 http://seclists.org/fulldisclosure/2019/Nov/14 · Exploit
• 🔥 http://packetstormsecurity.com/files/155361/FreeRadius-3.0.19-Logrotate-Privilege-Escalation.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-10143 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2019-10143 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TKODLHHUOVAYENTBP4D3N25ST3Q6LJBP · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0007 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10143 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-10143 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/TKODLHHUOVAYENTBP4D3N25ST3Q6LJBP · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-10143 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/USTITI4A3TVUX3SGO7TJCJ4WWFBZFWLZ · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10143 · Security Note
• https://linux.oracle.com/errata/ELSA-2019-3353.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-3984.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0007.html · Security Note