OpenSUSE Linux update for freeradius-server

Published: 2019-05-14 11:57:37
Severity Medium
Patch available YES
Number of vulnerabilities 2
CVE ID CVE-2019-11234
CVE-2019-11235
CVSSv3 6.6 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C]
6.6 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C]
CWE ID CWE-287
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Public exploit code for vulnerability #2 is available.
Vulnerable software Opensuse
Vulnerable software versions Opensuse 42.3
Vendor URL Novell

Security Advisory

1) Improper Authentication

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error related to processing authentication tokens. A remote attacker can execute a reflection attack and bypass authentication process.

This vulnerability was dubbed "Dragonblood".

Remediation

Update the affected packages.

External links

https://lists.opensuse.org/opensuse-security-announce/2019-05/msg00032.html

2) Improper Authentication

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to FreeRadius mishandles secure checks when preforming user authentication process. The related checks refer to mechanisms, which ensures that "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used". A remote attacker can bypass authentication process.

Remediation

Update the affected packages.

External links

https://lists.opensuse.org/opensuse-security-announce/2019-05/msg00032.html

Back to List