Bug 1456697 (CVE-2017-9148) - CVE-2017-9148 freeradius: TLS resumption authentication bypass
Summary: CVE-2017-9148 freeradius: TLS resumption authentication bypass
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-9148
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1456698 1458746 1459131
Blocks: 1456700
TreeView+ depends on / blocked
 
Reported: 2017-05-30 07:48 UTC by Andrej Nemec
Modified: 2021-02-17 02:06 UTC (History)
8 users (show)

Fixed In Version: freeradius 3.0.14
Doc Type: If docs needed, set a value
Doc Text:
An authentication bypass flaw was found in the way the EAP module in FreeRADIUS handled TLS session resumption. A remote unauthenticated attacker could potentially use this flaw to bypass the inner authentication check in FreeRADIUS by resuming an older unauthenticated TLS session.
Clone Of:
Environment:
Last Closed: 2017-07-25 21:11:01 UTC
Embargoed:

Attachments (Terms of Use)
Backported fix for FreeRADIUS 3.0.4 (1.39 KB, patch)
2017-06-15 10:00 UTC, Dhiru Kholia 		no flags Details | Diff
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:1581 0 normal SHIPPED_LIVE Important: freeradius security update 2017-06-28 09:08:07 UTC

Description Andrej Nemec 2017-05-30 07:48:49 UTC 
The TLS session cache in FreeRADIUS fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.

References:

http://seclists.org/oss-sec/2017/q2/342
http://seclists.org/oss-sec/2017/q2/422
http://freeradius.org/security.html

Upstream patches:

https://github.com/FreeRADIUS/freeradius-server/commit/af030bd4
https://github.com/FreeRADIUS/freeradius-server/commit/8f53382c
Comment 1 Andrej Nemec 2017-05-30 07:49:23 UTC 
Created freeradius tracking bugs for this issue:

Affects: fedora-all [bug 1456698]
Comment 3 Dhiru Kholia 2017-06-06 06:58:58 UTC 
Mitigation:

Disable TLS session caching in FreeRADIUS by setting "enable = no" in the cache subsection of EAP module settings, which are in /etc/raddb/mods-available/eap file.
Comment 15 Dhiru Kholia 2017-06-15 10:00:37 UTC 
Created attachment 1287974 [details]
Backported fix for FreeRADIUS 3.0.4
Comment 16 errata-xmlrpc 2017-06-28 05:08:31 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:1581 https://access.redhat.com/errata/RHSA-2017:1581
Note You need to log in before you can comment on or make changes to this bug.