modules/rlmunix/rlmunix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the password expiration in /etc/shadow, which allows remote authenticated users to authenticate using an expired password.
DFN-CERT reported [1] a vulnerability in the OCSP feature in FreeRADIUS 2.1.11 where it does not verify the status of a certificate (e.g. if the certificate was revoked).
No further details, or a patch, were provided. According to the changelog on the FreeRADIUS site [2], OCSP support was added in version 2.1.11:
OCSP support from Alex Bergmann. See raddb/eap.conf, "ocsp" section.
Therefore earlier versions of FreeRADIUS are not affected by this flaw.
[1] http://seclists.org/oss-sec/2011/q3/105 [2] http://freeradius.org/
Statement:
Not vulnerable. This issue did not affect the versions of freeradius as shipped with Red Hat Enterprise Linux 4, 5, or 6.
Stack-based buffer overflow in the cbtlsverify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long "not after" timestamp in a client certificate.
Pierre Carrier reported a stack-based buffer overflow flaw in the FreeRADIUS rlmpap module. An authenticated user could trigger this issue by creating a large password, causing FreeRADIUS to crash. The stack protector and SSP variable re-ordering protections should help prevent this issue from being used to execute arbitrary code.
Upstream fixes: 2.x: https://github.com/FreeRADIUS/freeradius-server/commit/0d606cfc29a 3.x: https://github.com/FreeRADIUS/freeradius-server/commit/ff5147c9e5088c7 master: https://github.com/FreeRADIUS/freeradius-server/commit/f610864d4c8f51d
References: http://lists.freebsd.org/pipermail/freebsd-bugbusters/2014-February/000610.html
An FR-GV-206 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "DHCP - Read overflow when decoding option 63" and a denial of service.
An FR-GV-203 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Memory leak in decodetlv()" and a denial of service.
An FR-GV-204 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Memory leak in frdhcpdecode()" and a denial of service.
An FR-GV-202 issue in FreeRADIUS 2.x before 2.2.10 allows "Write overflow in radcoalesce()" - this allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code.
An FR-GV-205 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Buffer over-read in frdhcpdecodeoptions()" and a denial of service.