Test ID:	1.3.6.1.4.1.25623.1.0.890977
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DLA-977-1)
Summary:	The remote host is missing an update for the Debian 'freeradius' package(s) announced via the DLA-977-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'freeradius' package(s) announced via the DLA-977-1 advisory. Vulnerability Insight: Several issues were discovered in FreeRADIUS, a high-performance and highly configurable RADIUS server. CVE-2014-2015 A stack-based buffer overflow was found in the normify function in the rlm_pap module, which can be attacked by existing users to cause denial of service or other issues. CVE-2015-4680 It was discovered that freeradius failed to check revocation of intermediate CA certificates, thus accepting client certificates issued by revoked certificates from intermediate CAs. Note that to enable checking of intermediate CA certificates, it is necessary to enable the check_all_crl option of the EAP TLS section in eap.conf. This is only necessary for servers using certificates signed by intermediate CAs. Servers that use self-signed CAs are unaffected. CVE-2017-9148 The TLS session cache fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS. For Debian 7 Wheezy, these problems have been fixed in version 2.1.12+dfsg-1.2+deb7u1. We recommend that you upgrade your freeradius packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: [link moved to references] Affected Software/OS: 'freeradius' package(s) on Debian 7. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2014-2015 BugTraq ID: 65581 http://www.securityfocus.com/bid/65581 http://lists.freebsd.org/pipermail/freebsd-bugbusters/2014-February/000610.html http://lists.freebsd.org/pipermail/freebsd-bugbusters/2014-February/000612.html http://lists.freebsd.org/pipermail/freebsd-bugbusters/2014-February/000616.html http://www.openwall.com/lists/oss-security/2014/02/18/3 RedHat Security Advisories: RHSA-2015:1287 http://rhn.redhat.com/errata/RHSA-2015-1287.html http://ubuntu.com/usn/usn-2122-1 Common Vulnerability Exposure (CVE) ID: CVE-2015-4680 BugTraq ID: 75327 http://www.securityfocus.com/bid/75327 Bugtraq: 20150622 [oCERT-2015-008] FreeRADIUS insufficent CRL application (Google Search) http://www.securityfocus.com/archive/1/535810/100/0/threaded http://packetstormsecurity.com/files/132415/FreeRADIUS-Insufficient-CRL-Application.html http://www.ocert.org/advisories/ocert-2015-008.html http://www.securitytracker.com/id/1032690 SuSE Security Announcement: SUSE-SU-2017:0102 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00010.html Common Vulnerability Exposure (CVE) ID: CVE-2017-9148 BugTraq ID: 98734 http://www.securityfocus.com/bid/98734 https://security.gentoo.org/glsa/201706-27 http://freeradius.org/security.html http://seclists.org/oss-sec/2017/q2/422 RedHat Security Advisories: RHSA-2017:1581 https://access.redhat.com/errata/RHSA-2017:1581 http://www.securitytracker.com/id/1038576
Copyright	Copyright (C) 2018 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.