CVE-2017-9148: Critical severity FreeRADIUS freeradius vulnerability
The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.
Other sources
The TLS session cache in FreeRADIUS fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.
References:
http://seclists.org/oss-sec/2017/q2/342 http://seclists.org/oss-sec/2017/q2/422 http://freeradius.org/security.html
Upstream patches:
https://github.com/FreeRADIUS/freeradius-server/commit/af030bd4 https://github.com/FreeRADIUS/freeradius-server/commit/8f53382c
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-9148?
CVE-2017-9148 has a medium severity level due to its ability to bypass authentication.
How do I fix CVE-2017-9148?
To mitigate CVE-2017-9148, upgrade FreeRADIUS to version 3.0.14 or later.
Which versions of FreeRADIUS are affected by CVE-2017-9148?
FreeRADIUS versions 2.1.1 through 2.1.7, all 3.0.x versions before 3.0.14, and 3.1.x versions before February 4, 2017, are affected.
Can CVE-2017-9148 be exploited remotely?
Yes, remote attackers can exploit CVE-2017-9148 to bypass authentication.
What type of attacks can CVE-2017-9148 facilitate?
CVE-2017-9148 can facilitate unauthorized access via unauthenticated session resumption.