Test Kennung:	1.3.6.1.4.1.25623.1.1.10.2020.0007
Kategorie:	Mageia Linux Local Security Checks
Titel:	Mageia: Security Advisory (MGASA-2020-0007)
Zusammenfassung:	The remote host is missing an update for the 'freeradius' package(s) announced via the MGASA-2020-0007 advisory.
Beschreibung:	Summary: The remote host is missing an update for the 'freeradius' package(s) announced via the MGASA-2020-0007 advisory. Vulnerability Insight: Updated freeradius packages fix security vulnerabilities: It was discovered freeradius does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user (CVE-2019-10143). An information leak was discovered in the implementation of EAP-pwd in freeradius. An attacker could initiate several EAP-pwd handshakes to leak information, which can then be used to recover the user's WiFi password by performing dictionary and brute-force attacks (CVE-2019-13456). Denial of service issues due to multithreaded BN_CTX access (CVE-2019-17185). Affected Software/OS: 'freeradius' package(s) on Mageia 7. Solution: Please install the updated package(s). CVSS Score: 6.9 CVSS Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2019-10143 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10143 https://github.com/FreeRADIUS/freeradius-server/pull/2666 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TKODLHHUOVAYENTBP4D3N25ST3Q6LJBP/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6VKBZAZKJP5QKXDXRKCM2ZPZND3TFAX/ http://seclists.org/fulldisclosure/2019/Nov/14 http://packetstormsecurity.com/files/155361/FreeRadius-3.0.19-Logrotate-Privilege-Escalation.html https://freeradius.org/security/ RedHat Security Advisories: RHSA-2019:3353 https://access.redhat.com/errata/RHSA-2019:3353 Common Vulnerability Exposure (CVE) ID: CVE-2019-13456 https://bugzilla.redhat.com/show_bug.cgi?id=1737663 https://wpa3.mathyvanhoef.com SuSE Security Announcement: openSUSE-SU-2020:0553 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00039.html Common Vulnerability Exposure (CVE) ID: CVE-2019-17185
Copyright	Copyright (C) 2022 Greenbone AG

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.