Debian Security Advisory

DLA-977-1 freeradius -- LTS security update

Date Reported:

05 Jun 2017

Affected Packages:

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 742820, Bug 789623, Bug 863673.
In Mitre's CVE dictionary: CVE-2014-2015, CVE-2015-4680, CVE-2017-9148.

More information:

Several issues were discovered in FreeRADIUS, a high-performance and highly configurable RADIUS server.

CVE-2014-2015
A stack-based buffer overflow was found in the normify function in the rlm_pap module, which can be attacked by existing users to cause denial of service or other issues.
CVE-2015-4680
It was discovered that freeradius failed to check revocation of intermediate CA certificates, thus accepting client certificates issued by revoked certificates from intermediate CAs.

Note that to enable checking of intermediate CA certificates, it is necessary to enable the check_all_crl option of the EAP TLS section in eap.conf. This is only necessary for servers using certificates signed by intermediate CAs. Servers that use self-signed CAs are unaffected.
CVE-2017-9148
The TLS session cache fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.

For Debian 7 Wheezy, these problems have been fixed in version 2.1.12+dfsg-1.2+deb7u1.

We recommend that you upgrade your freeradius packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS