Bug 1234975 (CVE-2015-4680)

Summary: CVE-2015-4680 freeradius: insufficent CRL application
Product: [Other] Security Response Reporter: Vasyl Kaigorodov <vkaigoro>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: carnil, dpal, ebenes, jdennis, jrusnack, lemenkov, nikolai.kondrashov
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: FreeRADIUS 2.2.8, FreeRADIUS 3.0.9 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-09-03 05:20:43 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1234976    
Bug Blocks: 1234978    

Description Vasyl Kaigorodov 2015-06-23 15:54:06 UTC 
The FreeRADIUS server relies on OpenSSL to perform certificate validation,
including Certificate Revocation List (CRL) checks. The FreeRADIUS usage of
OpenSSL, in CRL application, limits the checks to leaf certificates,
therefore not detecting revocation of intermediate CA certificates.

An unexpired client certificate, issued by an intermediate CA with a revoked
certificate, is therefore accepted by FreeRADIUS.

Specifically sets the X509_V_FLAG_CRL_CHECK flag for leaf certificate CRL
checks, but does not use X509_V_FLAG_CRL_CHECK_ALL for CRL checks on the
complete trust chain.

The FreeRADIUS project advises that the recommended configuration is to use
self-signed CAs for all EAP-TLS methods.

Upstream fixes:
 - 2.x.x: https://github.com/FreeRADIUS/freeradius-server/commit/5e698b407dcac2bc45cf03484bac4398109d25c3
 - 3.0.x: https://github.com/FreeRADIUS/freeradius-server/commit/874b39451702338389260edbfc52b381b20352ec

External References:

http://freeradius.org/security.html
http://www.ocert.org/advisories/ocert-2015-008.html
Comment 1 Vasyl Kaigorodov 2015-06-23 15:54:28 UTC 
Created freeradius tracking bugs for this issue:

Affects: fedora-all [bug 1234976]