Bug 55520 - free radius security issues from 3.0.25
Summary: free radius security issues from 3.0.25
Status: CLOSED DUPLICATE of bug 55758
Alias: None
Product: UCS
Classification: Unclassified
Component: Radius
Version: UCS 5.0
Hardware: Other Linux
: P5 normal
Target Milestone: ---
Assignee: UCS maintainers
QA Contact: UCS maintainers
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-12-27 16:51 CET by Mirac Erdemiroglu
Modified: 2023-04-27 17:35 CEST (History)
4 users (show)

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?: Yes
School Customer affected?: Yes
ISV affected?:
Waiting Support: Yes
Flags outvoted (downgraded) after PO Review:
Ticket number: 2022122721001319
Bug group (optional): Security
Customer ID: 17994
Max CVSS v3 score:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Mirac Erdemiroglu univentionstaff 2022-12-27 16:51:49 CET
The app freeRadius has security issues on Version 3.0.25.

Here the Info from the BSI:
A remote, anonymous attacker can exploit multiple vulnerabilities in FreeRADIUS to disclose information or cause a denial of service condition.

https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-2411
Comment 1 Erik Damrose univentionstaff 2023-01-06 17:47:27 CET
The BSI Warning mentions two CVEs:

# CVE-2022-41859
No detailed information at debian yet, CVE is marked as reserved https://security-tracker.debian.org/tracker/CVE-2022-41859

Apparently ubuntu will not incorporate the fix in older versions, as the changes are to intrusive https://ubuntu.com/security/CVE-2022-41859

# CVE-2022-41861
https://security-tracker.debian.org/tracker/CVE-2022-41861

According to https://freeradius.org/security/ (2022):
A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash. This crash is not exploitable by end users. Only systems which are in the RADIUS circle of trust can send these malformed attributes to a server. No actions other than a crash are possible. As a result, the severity of this issue is low. A malicious RADIUS client or home server can do many worse things than crash the server. For example, it could cause all users to be authenticated, or cause all users to be rejected, or it could lie about all accounting data.
Comment 2 Stefan Gohmann univentionstaff 2023-04-27 17:35:36 CEST
Fixed with Bug #55758 and Bug #55761.

*** This bug has been marked as a duplicate of bug 55758 ***