FreeRADIUS up to 3.0.19 Logrotate access control ⚔ [Disputed]

Summaryinfo

A vulnerability classified as critical has been found in FreeRADIUS up to 3.0.19. Impacted is an unknown function of the component Logrotate Handler. This manipulation causes access control. This vulnerability is tracked as CVE-2019-10143. The attack is restricted to local execution. Moreover, an exploit is present. The real existence of this vulnerability is still doubted at the moment.

Detailsinfo

A vulnerability was found in FreeRADIUS up to 3.0.19 (Network Authentication Software). It has been declared as critical. Affected by this vulnerability is some unknown processing of the component Logrotate Handler. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-264. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user.

The weakness was disclosed 05/24/2019 as not defined bug report (Bugzilla). It is possible to read the advisory at bugzilla.redhat.com. This vulnerability is known as CVE-2019-10143 since 03/27/2019. Attacking locally is a requirement. Required for exploitation is a single authentication. Technical details are unknown but a public exploit is available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

A public exploit has been developed by Wolfgang Hotwagner and been published 7 months after the advisory. It is possible to download the exploit at 0day.today. It is declared as proof-of-concept. The real existence of this vulnerability is still doubted at the moment. The vulnerability scanner Nessus provides a plugin with the ID 291748 (MiracleLinux 7 : freeradius-3.0.13-15.el7 (AXSA:2020-624:01)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (291748). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Network Authentication Software

Name

• FreeRADIUS

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8
• 3.0.9
• 3.0.10
• 3.0.11
• 3.0.12
• 3.0.13
• 3.0.14
• 3.0.15
• 3.0.16
• 3.0.17
• 3.0.18
• 3.0.19

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion