#VU18336 Improper Authentication in FreeRADIUS - CVE-2019-11235

Vulnerability identifier: #VU18336

Vulnerability risk: Medium

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/U:Green

CVE-ID: CVE-2019-11235

CWE-ID: CWE-287

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
FreeRADIUS

Software vendor:
FreeRADIUS Server Project

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to FreeRadius mishandles secure checks when preforming user authentication process. The related checks refer to mechanisms, which ensures that "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used". A remote attacker can bypass authentication process.

Install updates from vendor's website.

• https://bugzilla.redhat.com/show_bug.cgi?id=1695748
• https://freeradius.org/release_notes/?br=3.0.x&re=3.0.19
• https://freeradius.org/security/
• https://papers.mathyvanhoef.com/dragonblood.pdf
• https://usn.ubuntu.com/3954-1/
• https://www.kb.cert.org/vuls/id/871675/