Resource management error in FreeRADIUS - CVE-2019-17185

Vulnerability identifier: #VU27346

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-17185

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the EAP-pwd module uses a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. A remote attacker can perform multiple login attempts and crash the daemon.

FreeRADIUS
freeradius (Red Hat package)
freeradius (Ubuntu package)
freeradius-help
python2-freeradius
freeradius-utils
freeradius-sqlite
freeradius-postgresql
freeradius-perl
freeradius-mysql
freeradius-ldap
freeradius-krb5
freeradius-devel
freeradius-debugsource
freeradius-debuginfo
freeradius
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Opensuse
Ubuntu
openEuler

Install updates from vendor's website.

FreeRADIUS - update to 3.0.20
freeradius (Red Hat package) - update to 3.0.13-15.el7
freeradius (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 3.0.16+dfsg-1ubuntu3.2, 3.0.20+dfsg-3ubuntu0.2, 3.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu3.1
freeradius-help - update to 3.0.15-21
python2-freeradius - update to 3.0.15-21
freeradius-utils - update to 3.0.15-21
freeradius-sqlite - update to 3.0.15-21
freeradius-postgresql - update to 3.0.15-21
freeradius-perl - update to 3.0.15-21
freeradius-mysql - update to 3.0.15-21
freeradius-ldap - update to 3.0.15-21
freeradius-krb5 - update to 3.0.15-21
freeradius-devel - update to 3.0.15-21
freeradius-debugsource - update to 3.0.15-21
freeradius-debuginfo - update to 3.0.15-21
freeradius - update to 3.0.15-21

• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00039.html
• https://freeradius.org/security/
• https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_0_20

• Multiple vulnerabilities in FreeRADIUS
• OpenSUSE Linux update for freeradius-server
• Red Hat Enterprise Linux 7 update for freeradius
• Red Hat Enterprise Linux 8 update for the freeradius:3.0 module
• Ubuntu update for freeradius
• openEuler update for freeradius