Permissions, Privileges, and Access Controls in freeradius (Alpine package)
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2019-10143 |
| CWE-ID | CWE-264 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software |
freeradius (Alpine package) Operating systems & Components / Operating system package or component |
| Vendor | Alpine Linux Development Team |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Permissions, Privileges, and Access Controls
EUVDB-ID: #VU33417
Risk: Low
CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2019-10143
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a local authenticated user to execute arbitrary code.
** DISPUTED ** It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user. NOTE: the upstream software maintainer has stated "there is simply no way for anyone to gain privileges through this alleged issue."
MitigationInstall update from vendor's website.
Vulnerable software versionsfreeradius (Alpine package): 3.0.15-r4 - 3.0.17-r3
CPE2.3- cpe:2.3:a:alpine:freeradius_alpine_package:3.0.15-r4:*:*:*:*:alpine_linux:*:3.6
- cpe:2.3:a:alpine:freeradius_alpine_package:3.0.15-r5:*:*:*:*:alpine_linux:*:3.6
- cpe:2.3:a:alpine:freeradius_alpine_package:3.0.16-r0:*:*:*:*:alpine_linux:*:3.7
https://git.alpinelinux.org/aports/commit/?id=845ceeb84a5356dfef381071a5fcbffff147dd8e
https://git.alpinelinux.org/aports/commit/?id=9efccd10b731a53429a96bea0144057e3753ddef
https://git.alpinelinux.org/aports/commit/?id=f15e593c31c3b529bf34eb9eae1e428258c6f030
https://git.alpinelinux.org/aports/commit/?id=10fc00b3dbc9a5c90dd9c54ae5c6f94975e6b63b
https://git.alpinelinux.org/aports/commit/?id=39ad148a1b03ffa56801c3ded59b34d6ac0e4dd1
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
