Veracode Vulnerability DatabaseVERACODE:10697Authentication Bypass
0.003 Low
EPSS
Percentile
70.9%
freeradius is vulnerable to authentication bypass attacks. The vulnerability exists due to the failure to check on password expiration in /etc/shadow in modules/rlm_unix/rlm_unix.c in FreeRADIUS before 2.2.0, when unix mode is used for user authentication. This allows an expired password to be used for authentication.
| CPE | Name | Operator | Version |
|---|---|---|---|
| freeradius | eq | 2.1.9__3.el6 | |
| freeradius | eq | 2.1.10__5.el6 | |
| freeradius2 | eq | 2.1.12__3.el5 | |
| freeradius2 | eq | 2.1.7__7.el5 |
References
lists.opensuse.org/opensuse-updates/2013-01/msg00029.html
lists.opensuse.org/opensuse-updates/2013-01/msg00079.html
rhn.redhat.com/errata/RHBA-2012-0881.html
rhn.redhat.com/errata/RHSA-2013-0134.html
access.redhat.com/security/cve/CVE-2011-4966
bugzilla.redhat.com/show_bug.cgi?id=690756
bugzilla.redhat.com/show_bug.cgi?id=700870
bugzilla.redhat.com/show_bug.cgi?id=705723
bugzilla.redhat.com/show_bug.cgi?id=712803
bugzilla.redhat.com/show_bug.cgi?id=753764
bugzilla.redhat.com/show_bug.cgi?id=782905
bugzilla.redhat.com/show_bug.cgi?id=787116
bugzilla.redhat.com/show_bug.cgi?id=810605
github.com/alandekok/freeradius-server/commit/1b1ec5ce75e224bd1755650c18ccdaa6dc53e605
rhn.redhat.com/errata/RHBA-2012-0881.html
Related
