Improper Authentication in FreeRADIUS - CVE-2019-11235

Vulnerability identifier: #VU18336

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-11235

CWE-ID: CWE-287

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to FreeRadius mishandles secure checks when preforming user authentication process. The related checks refer to mechanisms, which ensures that "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used". A remote attacker can bypass authentication process.

FreeRADIUS
freeradius (Alpine package)
freeradius (Ubuntu package)
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power
Opensuse
Operational Decision Manager
Dell PowerProtect Cyber Recovery

Install updates from vendor's website.

FreeRADIUS - update to 3.0.19
freeradius (Alpine package) - update to 3.0.13-r3
freeradius (Ubuntu package) - addressed in versions 3.0.16+dfsg-3ubuntu1.1, 3.0.16+dfsg-1ubuntu3.1, 3.0.17+dfsg-1ubuntu2.1
Operational Decision Manager - addressed in versions 8.10.5.1 Interim fix 49, 8.11.0.1 Interim fix 26, 8.12.0 Interim fix 8
Dell PowerProtect Cyber Recovery - update to 18.1.1.2-8

• https://bugzilla.redhat.com/show_bug.cgi?id=1695748
• https://freeradius.org/release_notes/?br=3.0.x&re=3.0.19
• https://freeradius.org/security/
• https://papers.mathyvanhoef.com/dragonblood.pdf
• https://usn.ubuntu.com/3954-1/
• https://www.kb.cert.org/vuls/id/871675/

• Authentication bypass in FreeRADIUS
• Ubuntu update for FreeRADIUS
• OpenSUSE Linux update for freeradius-server
• OpenSUSE Linux update for freeradius-server
• Red Hat update for freeradius
• Red Hat update for freeradius:3.0
• OpenSUSE Linux update for freeradius-server
• Improper Authentication in freeradius (Alpine package)
• Multiple vulnerabilities in Dell EMC Cyber Recovery
• Multiple vulnerabilities in IBM Operational Decision Manager