Rapid7 Vulnerability & Exploit Database

Oracle Linux: CVE-2017-9148: ELSA-2017-1581: freeradius security update (IMPORTANT)

Free InsightVM Trial No Credit Card Necessary
2024 Attack Intel Report Latest research by Rapid7 Labs
Back to Search

Oracle Linux: CVE-2017-9148: ELSA-2017-1581: freeradius security update (IMPORTANT)

Severity
7
CVSS
(AV:N/AC:H/Au:N/C:C/I:C/A:N)
Published
05/08/2017
Created
07/25/2018
Added
06/29/2017
Modified
07/22/2024

Description

The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS. An authentication bypass flaw was found in the way the EAP module in FreeRADIUS handled TLS session resumption. A remote unauthenticated attacker could potentially use this flaw to bypass the inner authentication check in FreeRADIUS by resuming an older unauthenticated TLS session.

Solution(s)

  • oracle-linux-upgrade-freeradius
  • oracle-linux-upgrade-freeradius-devel
  • oracle-linux-upgrade-freeradius-doc
  • oracle-linux-upgrade-freeradius-krb5
  • oracle-linux-upgrade-freeradius-ldap
  • oracle-linux-upgrade-freeradius-mysql
  • oracle-linux-upgrade-freeradius-perl
  • oracle-linux-upgrade-freeradius-postgresql
  • oracle-linux-upgrade-freeradius-python
  • oracle-linux-upgrade-freeradius-sqlite
  • oracle-linux-upgrade-freeradius-unixodbc
  • oracle-linux-upgrade-freeradius-utils

References

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;