USN-7055-1: FreeRADIUS vulnerability
Goldberg, Miro Haller, Nadia Heninger, Mike Milano, Dan Shumow, Marc Stevens, and Adam Suhl discovered that FreeRADIUS incorrectly authenticated certain responses. An attacker able to intercept communications between a RADIUS client and server could possibly use this issue to forge responses, bypass authentication, and access network devices and services. This update introduces new configuration options called "limitproxystate" and "requiremessageauthenticator" that default to "auto" but should be set to "yes" once all RADIUS devices have been upgraded on a network.
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-7055-1?
USN-7055-1 is considered a high severity vulnerability due to the potential for an attacker to forge responses in FreeRADIUS communications.
How do I fix USN-7055-1?
To resolve USN-7055-1, update FreeRADIUS to the patched versions 3.2.5+dfsg-3~ubuntu24.04.1, 3.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu3.3, or 3.0.20+dfsg-3ubuntu0.4 depending on your Ubuntu version.
What products are affected by USN-7055-1?
USN-7055-1 affects FreeRADIUS on Ubuntu versions 20.04, 22.04, and 24.04.
Can USN-7055-1 lead to unauthorized access?
Yes, USN-7055-1 can potentially allow unauthorized access due to improper authentication mechanisms.
Is there a workaround for USN-7055-1?
There is no recommended workaround for USN-7055-1; updating to the fixed versions is essential.