CVE-2015-4680: High severity freeradius freeradius vulnerability
FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.
Other sources
The FreeRADIUS server relies on OpenSSL to perform certificate validation, including Certificate Revocation List (CRL) checks. The FreeRADIUS usage of OpenSSL, in CRL application, limits the checks to leaf certificates, therefore not detecting revocation of intermediate CA certificates.
An unexpired client certificate, issued by an intermediate CA with a revoked certificate, is therefore accepted by FreeRADIUS.
Specifically sets the X509VFLAGCRLCHECK flag for leaf certificate CRL checks, but does not use X509VFLAGCRLCHECKALL for CRL checks on the complete trust chain.
The FreeRADIUS project advises that the recommended configuration is to use self-signed CAs for all EAP-TLS methods.
Upstream fixes: - 2.x.x: https://github.com/FreeRADIUS/freeradius-server/commit/5e698b407dcac2bc45cf03484bac4398109d25c3 - 3.0.x: https://github.com/FreeRADIUS/freeradius-server/commit/874b39451702338389260edbfc52b381b20352ec
External References:
http://freeradius.org/security.html http://www.ocert.org/advisories/ocert-2015-008.html
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-4680?
CVE-2015-4680 has been classified as a medium severity vulnerability due to improper revocation checking of intermediate CA certificates.
How do I fix CVE-2015-4680?
To fix CVE-2015-4680, upgrade FreeRADIUS to version 2.2.8 or 3.0.9 or later.
Which versions of FreeRADIUS are affected by CVE-2015-4680?
CVE-2015-4680 affects FreeRADIUS versions 2.2.x prior to 2.2.8 and 3.0.x prior to 3.0.9.
What is the impact of CVE-2015-4680 on FreeRADIUS?
CVE-2015-4680 can potentially allow an attacker to bypass certificate revocation checks, leading to unauthorized access.
Is there a workaround for CVE-2015-4680?
There is no known workaround for CVE-2015-4680; upgrading to a patched version is recommended.