エラータID: AXSA:2020-624:01

Release date: 
Wednesday, October 7, 2020 - 23:49
Affected Channels: 
Asianux Server 7 for x86_64

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.

Security Fix(es):

* freeradius: privilege escalation due to insecure logrotate configuration (CVE-2019-10143)

* freeradius: eap-pwd: Information leak due to aborting when needing more than 10 iterations (CVE-2019-13456)

* freeradius: eap-pwd: DoS issues due to multithreaded BN_CTX access (CVE-2019-17185)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

** DISPUTED ** It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user. NOTE: the upstream software maintainer has stated "there is simply no way for anyone to gain privileges through this alleged issue."
In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This information leakage is similar to the "Dragonblood" attack and CVE-2019-9494.
In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.


Update packages.

Additional Info: 



  1. freeradius-3.0.13-15.el7.src.rpm
    MD5: cc3e46cb7b414a04c1dbf09968f0a265
    SHA-256: 2dfa93c0a076aa7b7a731fcbd77683f3b1a59c5aedd912b8c17e4f35b7710aba
    Size: 3.01 MB

Asianux Server 7 for x86_64
  1. freeradius-3.0.13-15.el7.x86_64.rpm
    MD5: 1408c6e52556f3ef8f834aa961ffeab1
    SHA-256: 1cf36efcdbfaec677deb933afc973a1d5c331079977324ffada3753983971854
    Size: 1.07 MB