This update fixes a denial of service (crash) security issue rlm_pap hash processing in FreeRadius, which could have been caused by special passwords fed into the RLM-PAP password checking method via LDAP by remote attackers.

Updated freeradius packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.

A stack-based buffer overflow was found in the way the FreeRADIUS rlm_pap module handled long password hashes. An attacker able to make radiusd process a malformed password hash could cause the daemon to crash. (CVE-2014-2015)

The freeradius packages have been upgraded to upstream version 2.2.6, which provides a number of bug fixes and enhancements over the previous version, including :

* The number of dictionaries have been updated.

* This update implements several Extensible Authentication Protocol (EAP) improvements.

* A number of new expansions have been added, including:
%{randstr:...}, %{hex:...}, %{sha1:...}, %{base64:...}, %{tobase64:...}, and %{base64tohex:...}.

* Hexadecimal numbers (0x...) are now supported in %{expr:...} expansions.

* This update adds operator support to the rlm_python module.

* The Dynamic Host Configuration Protocol (DHCP) and DHCP relay code have been finalized.

* This update adds the rlm_cache module to cache arbitrary attributes.

For a complete list of bug fixes and enhancements provided by this rebase, see the freeradius changelog linked to in the References section.

(BZ#1078736)

This update also fixes the following bugs :

* The /var/log/radius/radutmp file was configured to rotate at one-month intervals, even though this was unnecessary. This update removes /var/log/radius/radutmp from the installed logrotate utility configuration in the /etc/logrotate.d/radiusd file, and /var/log/radius/radutmp is no longer rotated. (BZ#904578)

* The radiusd service could not write the output file created by the raddebug utility. The raddebug utility now sets appropriate ownership to the output file, allowing radiusd to write the output. (BZ#921563)

* After starting raddebug using the 'raddebug -t 0' command, raddebug exited immediately. A typo in the special case comparison has been fixed, and raddebug now runs for 11.5 days in this situation.
(BZ#921567)

* MS-CHAP authentication failed when the User-Name and MS-CHAP-User-Name attributes used different encodings, even when the user provided correct credentials. Now, MS-CHAP authentication properly handles mismatching character encodings. Authentication with correct credentials no longer fails in this situation. (BZ#1060319)

* Automatically generated default certificates used the SHA-1 algorithm message digest, which is considered insecure. The default certificates now use the more secure SHA-256 algorithm message digest.
(BZ#1135439)

* During the Online Certificate Status Protocol (OCSP) validation, radiusd terminated unexpectedly with a segmentation fault after attempting to access the next update field that was not provided by the OCSP responder. Now, radiusd does not crash in this situation and instead continues to complete the OCSP validation. (BZ#1142669)

* Prior to this update, radiusd failed to work with some of the more recent MikroTIK attributes, because the installed directory.mikrotik file did not include them. This update adds MikroTIK attributes with IDs up to 22 to dictionary.mikrotik, and radiusd now works as expected with these attributes. (BZ#1173388)

Users of freeradius are advised to upgrade to these updated packages, which correct these issues and add these enhancements. After installing this update, the radiusd service will be restarted automatically.

Updated freeradius package fixes security vulnerability :

SSHA processing in freeradius before 2.2.3 runs into a stack-based buffer overflow in the freeradius rlm_pap module if the password source uses an unusually long hashed password (CVE-2014-2015).

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-1287 advisory.

    [2.2.6-4]
    - Move OpenSSL init out of version check       Resolves: Bug#1189394 radiusd segfaults after update
    - Comment-out ippool-dhcp.conf inclusion       Resolves: Bug#1189386 radiusd fails to start after 'clean' installation

    [2.2.6-3]
    - Disable OpenSSL version check       Resolves: Bug#1189011

    [2.2.6-2]
    - Fix a number of new Coverity errors and compiler warnings.
      Resolves: Bug#1188598

    [2.2.6-1]
    - Upgrade to the latest upstream release v2.2.6       Resolves: Bug#921563  raddebug not working correctly       Resolves: Bug#921567  raddebug -t 0 exists immediately       Resolves: Bug#1060319 MSCHAP Authentication is not working using automatic                             windows user credentials       Resolves: Bug#1078736 Rebase FreeRADIUS to 2.2.4       Resolves: Bug#1135439 Default message digest defaults to sha1       Resolves: Bug#1142669 EAP-TLS and OCSP validation causing segmentation                             fault       Resolves: Bug#1173388 dictionary.mikrotik missing Attributes
    - Remove radutmp rotation       Resolves: Bug#904578  radutmp should not rotate
    - Check for start_servers not exceeding max_servers       Resolves: Bug#1146828 radiusd silently fails when start_servers is higher                             than max_servers

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that FreeRADIUS incorrectly handled unix authentication. A remote user could successfully authenticate with an expired password. (CVE-2011-4966)

Pierre Carrier discovered that FreeRADIUS incorrectly handled rlm_pap hash processing. An authenticated user could use this issue to cause FreeRADIUS to crash, resulting in a denial of service, or possibly execute arbitrary code. The default compiler options for affected releases should reduce the vulnerability to a denial of service.
(CVE-2014-2015).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Stack-based buffer overflow in the normify function in the rlm_pap module (modules/rlm_pap/rlm_pap.c) in     FreeRADIUS 2.x, possibly 2.2.3 and earlier, and 3.x, possibly 3.0.1 and earlier, might allow attackers to     cause a denial of service (crash) and possibly execute arbitrary code via a long password hash, as     demonstrated by an SSHA hash. (CVE-2014-2015)

Note that Nessus relies on the presence of the package as reported by the vendor.

A stack-based buffer overflow was found in the way the FreeRADIUS rlm_pap module handled long password hashes. An attacker able to make radiusd process a malformed password hash could cause the daemon to crash. (CVE-2014-2015)

The freeradius packages have been upgraded to upstream version 2.2.6, which provides a number of bug fixes and enhancements over the previous version, including :

  - The number of dictionaries have been updated.

  - This update implements several Extensible Authentication     Protocol (EAP) improvements.

  - A number of new expansions have been added, including:
    %{randstr:...}, %{hex:...}, %{sha1:...}, %{base64:...},     %{tobase64:...}, and %{base64tohex:...}.

  - Hexadecimal numbers (0x...) are now supported in     %{expr:...} expansions.

  - This update adds operator support to the rlm_python     module.

  - The Dynamic Host Configuration Protocol (DHCP) and DHCP     relay code have been finalized.

  - This update adds the rlm_cache module to cache arbitrary     attributes.

This update also fixes the following bugs :

  - The /var/log/radius/radutmp file was configured to     rotate at one-month intervals, even though this was     unnecessary. This update removes /var/log/radius/radutmp     from the installed logrotate utility configuration in     the /etc/logrotate.d/radiusd file, and     /var/log/radius/radutmp is no longer rotated.

  - The radiusd service could not write the output file     created by the raddebug utility. The raddebug utility     now sets appropriate ownership to the output file,     allowing radiusd to write the output.

  - After starting raddebug using the 'raddebug -t 0'     command, raddebug exited immediately. A typo in the     special case comparison has been fixed, and raddebug now     runs for 11.5 days in this situation.

  - MS-CHAP authentication failed when the User-Name and     MS-CHAP-User-Name attributes used different encodings,     even when the user provided correct credentials. Now,     MS-CHAP authentication properly handles mismatching     character encodings. Authentication with correct     credentials no longer fails in this situation.

  - Automatically generated default certificates used the     SHA-1 algorithm message digest, which is considered     insecure. The default certificates now use the more     secure SHA-256 algorithm message digest.

  - During the Online Certificate Status Protocol (OCSP)     validation, radiusd terminated unexpectedly with a     segmentation fault after attempting to access the next     update field that was not provided by the OCSP     responder. Now, radiusd does not crash in this situation     and instead continues to complete the OCSP validation.

  - Prior to this update, radiusd failed to work with some     of the more recent MikroTIK attributes, because the     installed directory.mikrotik file did not include them.
    This update adds MikroTIK attributes with IDs up to 22     to dictionary.mikrotik, and radiusd now works as     expected with these attributes.

After installing this update, the radiusd service will be restarted automatically.

A stack-based buffer overflow was found in the way the FreeRADIUS rlm_pap module handled long password hashes. An attacker able to make radiusd process a malformed password hash could cause the daemon to crash.

Fix stack-based buffer overflow flaw in rlm_pap module: long password hashes used by the PAP module can cause a buffer overflow which may terminate the server.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
73510	SuSE 11.3 Security Update : freeradius (SAT Patch Number 8968)	Nessus	SuSE Local Security Checks	2014/4/15	2021/1/19	high
84937	RHEL 6 : freeradius (RHSA-2015:1287)	Nessus	Red Hat Local Security Checks	2015/7/23	2021/2/5	high
73005	Mandriva Linux Security Advisory : freeradius (MDVSA-2014:058)	Nessus	Mandriva Local Security Checks	2014/3/14	2021/1/6	high
85098	Oracle Linux 6 : freeradius (ELSA-2015-1287)	Nessus	Oracle Linux Local Security Checks	2015/7/30	2024/10/22	critical
72719	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.10 : freeradius vulnerabilities (USN-2122-1)	Nessus	Ubuntu Local Security Checks	2014/2/27	2021/1/19	high
218085	Linux Distros Unpatched Vulnerability : CVE-2014-2015	Nessus	Misc.	2025/3/4	2026/4/28	critical
85192	Scientific Linux Security Update : freeradius on SL6.x i386/x86_64 (20150722)	Nessus	Scientific Linux Local Security Checks	2015/8/4	2021/1/14	high
85454	Amazon Linux AMI : freeradius (ALAS-2015-581)	Nessus	Amazon Linux Local Security Checks	2015/8/18	2018/4/18	high
85011	CentOS 6 : freeradius (CESA-2015:1287)	Nessus	CentOS Local Security Checks	2015/7/28	2021/1/4	high
72888	Fedora 19 : freeradius-2.2.3-7.fc19 (2014-3192)	Nessus	Fedora Local Security Checks	2014/3/10	2021/1/11	high

偵測

搜尋 Plugin

high

high

high

critical

high

critical

high

high

high

high