ID de Prueba:	1.3.6.1.4.1.25623.1.1.10.2020.0007
Categoría:	Mageia Linux Local Security Checks
Título:	Mageia: Security Advisory (MGASA-2020-0007)
Resumen:	The remote host is missing an update for the 'freeradius' package(s) announced via the MGASA-2020-0007 advisory.
Descripción:	Summary: The remote host is missing an update for the 'freeradius' package(s) announced via the MGASA-2020-0007 advisory. Vulnerability Insight: Updated freeradius packages fix security vulnerabilities: It was discovered freeradius does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user (CVE-2019-10143). An information leak was discovered in the implementation of EAP-pwd in freeradius. An attacker could initiate several EAP-pwd handshakes to leak information, which can then be used to recover the user's WiFi password by performing dictionary and brute-force attacks (CVE-2019-13456). Denial of service issues due to multithreaded BN_CTX access (CVE-2019-17185). Affected Software/OS: 'freeradius' package(s) on Mageia 7. Solution: Please install the updated package(s). CVSS Score: 6.9 CVSS Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2019-10143 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10143 https://github.com/FreeRADIUS/freeradius-server/pull/2666 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TKODLHHUOVAYENTBP4D3N25ST3Q6LJBP/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6VKBZAZKJP5QKXDXRKCM2ZPZND3TFAX/ http://seclists.org/fulldisclosure/2019/Nov/14 http://packetstormsecurity.com/files/155361/FreeRadius-3.0.19-Logrotate-Privilege-Escalation.html https://freeradius.org/security/ RedHat Security Advisories: RHSA-2019:3353 https://access.redhat.com/errata/RHSA-2019:3353 Common Vulnerability Exposure (CVE) ID: CVE-2019-13456 https://bugzilla.redhat.com/show_bug.cgi?id=1737663 https://wpa3.mathyvanhoef.com SuSE Security Announcement: openSUSE-SU-2020:0553 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00039.html Common Vulnerability Exposure (CVE) ID: CVE-2019-17185
Copyright	Copyright (C) 2022 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.