FreeRADIUS up to 3.0.19 EAP-PWD Handshake input validation

Summaryinfo

A vulnerability identified as problematic has been detected in FreeRADIUS. This affects an unknown function of the component EAP-PWD Module. This manipulation as part of Handshake causes input validation. This vulnerability is handled as CVE-2019-17185. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in FreeRADIUS (Network Authentication Software) and classified as problematic. Affected by this vulnerability is some unknown functionality of the component EAP-PWD Module. The manipulation as part of a Handshake leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect availability. The summary by CVE is:

In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.

The weakness was released 03/21/2020 (GitHub Repository). It is possible to read the advisory at github.com. This vulnerability is known as CVE-2019-17185 since 10/04/2019. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 291748 (MiracleLinux 7 : freeradius-3.0.13-15.el7 (AXSA:2020-624:01)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.0.20 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (291748). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Network Authentication Software

Name

• FreeRADIUS

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8
• 3.0.9
• 3.0.10
• 3.0.11
• 3.0.12
• 3.0.13
• 3.0.14
• 3.0.15
• 3.0.16
• 3.0.17
• 3.0.18
• 3.0.19

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion