A stack-based buffer overflow was found in the way the FreeRADIUS rlm_pap module handled long password hashes. An attacker able to make radiusd process a malformed password hash could cause the daemon to crash. (CVE-2014-2015)

The freeradius packages have been upgraded to upstream version 2.2.6, which provides a number of bug fixes and enhancements over the previous version, including :

  - The number of dictionaries have been updated.

  - This update implements several Extensible Authentication     Protocol (EAP) improvements.

  - A number of new expansions have been added, including:
    %{randstr:...}, %{hex:...}, %{sha1:...}, %{base64:...},     %{tobase64:...}, and %{base64tohex:...}.

  - Hexadecimal numbers (0x...) are now supported in     %{expr:...} expansions.

  - This update adds operator support to the rlm_python     module.

  - The Dynamic Host Configuration Protocol (DHCP) and DHCP     relay code have been finalized.

  - This update adds the rlm_cache module to cache arbitrary     attributes.

This update also fixes the following bugs :

  - The /var/log/radius/radutmp file was configured to     rotate at one-month intervals, even though this was     unnecessary. This update removes /var/log/radius/radutmp     from the installed logrotate utility configuration in     the /etc/logrotate.d/radiusd file, and     /var/log/radius/radutmp is no longer rotated.

  - The radiusd service could not write the output file     created by the raddebug utility. The raddebug utility     now sets appropriate ownership to the output file,     allowing radiusd to write the output.

  - After starting raddebug using the 'raddebug -t 0'     command, raddebug exited immediately. A typo in the     special case comparison has been fixed, and raddebug now     runs for 11.5 days in this situation.

  - MS-CHAP authentication failed when the User-Name and     MS-CHAP-User-Name attributes used different encodings,     even when the user provided correct credentials. Now,     MS-CHAP authentication properly handles mismatching     character encodings. Authentication with correct     credentials no longer fails in this situation.

  - Automatically generated default certificates used the     SHA-1 algorithm message digest, which is considered     insecure. The default certificates now use the more     secure SHA-256 algorithm message digest.

  - During the Online Certificate Status Protocol (OCSP)     validation, radiusd terminated unexpectedly with a     segmentation fault after attempting to access the next     update field that was not provided by the OCSP     responder. Now, radiusd does not crash in this situation     and instead continues to complete the OCSP validation.

  - Prior to this update, radiusd failed to work with some     of the more recent MikroTIK attributes, because the     installed directory.mikrotik file did not include them.
    This update adds MikroTIK attributes with IDs up to 22     to dictionary.mikrotik, and radiusd now works as     expected with these attributes.

After installing this update, the radiusd service will be restarted automatically.

A stack-based buffer overflow was found in the way the FreeRADIUS rlm_pap module handled long password hashes. An attacker able to make radiusd process a malformed password hash could cause the daemon to crash.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0415 advisory.

    This advisory aggregates security fixes for the freeradius SRPM in CIQ LTS 9.2. It addresses 13 CVEs:
    CVE-2017-10978, CVE-2017-10983, CVE-2017-10986, CVE-2014-2015, CVE-2014-0160, and 8 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2015-304:01 advisory.

    The FreeRADIUS Server Project is a high performance and highly configurable     GPL'd free RADIUS server. The server is similar in some respects to     Livingston's 2.0 server.  While FreeRADIUS started as a variant of the     Cistron RADIUS server, they don't share a lot in common any more. It now has     many more features than Cistron or Livingston, and is much more configurable.
    FreeRADIUS is an Internet authentication daemon, which implements the RADIUS     protocol, as defined in RFC 2865 (and others). It allows Network Access     Servers (NAS boxes) to perform authentication for dial-up users. There are     also RADIUS clients available for Web servers, firewalls, Unix logins, and     more.  Using RADIUS allows authentication and authorization for a network to     be centralized, and minimizes the amount of re-configuration which has to be     done when adding or deleting new users.
    Security issues fixed with this release:
    CVE-2014-2015     Fixed bugs:
    * The number of dictionaries have been updated.
    * This update implements several Extensible Authentication Protocol (EAP)     improvements.
    * A number of new expansions have been added, including: %{randstr:...},     %{hex:...}, %{sha1:...}, %{base64:...}, %{tobase64:...}, and %{base64tohex:...}.
    * Hexadecimal numbers (0x...) are now supported in %{expr:...} expansions.
    * This update adds operator support to the rlm_python module.
    * The Dynamic Host Configuration Protocol (DHCP) and DHCP relay code have been     finalized.
    * This update adds the rlm_cache module to cache arbitrary attributes.
    * The /var/log/radius/radutmp file was configured to rotate at one-month     intervals, even though this was unnecessary. With this update,     the described problem was fixed.
    * The radiusd service could not write the output file created by the raddebug     utility. The raddebug utility now sets appropriate ownership to the output file,     allowing radiusd to write the output.
    * After starting raddebug using the raddebug -t 0 command, raddebug exited     immediately. A typo in the special case comparison has been fixed, and raddebug     now runs for 11.5 days in this situation.
    * MS-CHAP authentication failed when the User-Name and MS-CHAP-User-Name     attributes used different encodings, even when the user provided correct     credentials. With this update, authentication with correct credentials no longer fails in this     situation.
    * Automatically generated default certificates used the SHA-1 algorithm message     digest, which is considered insecure. The default certificates now use the more     secure SHA-256 algorithm message digest.
    * During the Online Certificate Status Protocol (OCSP) validation, radiusd     terminated unexpectedly with a segmentation fault after attempting to access the     next update field that was not provided by the OCSP responder. With this update,     this problem is fixed.
    * Previously, radiusd failed to work with some of the more recent     MikroTIK attributes, because the installed directory.mikrotik file did not     include them. With this update, the bug was fixed.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update fixes a denial of service (crash) security issue rlm_pap hash processing in FreeRadius, which could have been caused by special passwords fed into the RLM-PAP password checking method via LDAP by remote attackers.

The remote host is affected by the vulnerability described in GLSA-201406-12 (FreeRADIUS: Arbitrary code execution)

    Large passwords can trigger a stack-based buffer overflow in       FreeRADIUS&rsquo;s rlm_pap module when authenticating against an LDAP server.
  Impact :

    An authenticated user could set a specially crafted long password,       possibly leading to arbitrary code execution or a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

Updated freeradius packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.

A stack-based buffer overflow was found in the way the FreeRADIUS rlm_pap module handled long password hashes. An attacker able to make radiusd process a malformed password hash could cause the daemon to crash. (CVE-2014-2015)

The freeradius packages have been upgraded to upstream version 2.2.6, which provides a number of bug fixes and enhancements over the previous version, including :

* The number of dictionaries have been updated.

* This update implements several Extensible Authentication Protocol (EAP) improvements.

* A number of new expansions have been added, including:
%{randstr:...}, %{hex:...}, %{sha1:...}, %{base64:...}, %{tobase64:...}, and %{base64tohex:...}.

* Hexadecimal numbers (0x...) are now supported in %{expr:...} expansions.

* This update adds operator support to the rlm_python module.

* The Dynamic Host Configuration Protocol (DHCP) and DHCP relay code have been finalized.

* This update adds the rlm_cache module to cache arbitrary attributes.

For a complete list of bug fixes and enhancements provided by this rebase, see the freeradius changelog linked to in the References section.

(BZ#1078736)

This update also fixes the following bugs :

* The /var/log/radius/radutmp file was configured to rotate at one-month intervals, even though this was unnecessary. This update removes /var/log/radius/radutmp from the installed logrotate utility configuration in the /etc/logrotate.d/radiusd file, and /var/log/radius/radutmp is no longer rotated. (BZ#904578)

* The radiusd service could not write the output file created by the raddebug utility. The raddebug utility now sets appropriate ownership to the output file, allowing radiusd to write the output. (BZ#921563)

* After starting raddebug using the 'raddebug -t 0' command, raddebug exited immediately. A typo in the special case comparison has been fixed, and raddebug now runs for 11.5 days in this situation.
(BZ#921567)

* MS-CHAP authentication failed when the User-Name and MS-CHAP-User-Name attributes used different encodings, even when the user provided correct credentials. Now, MS-CHAP authentication properly handles mismatching character encodings. Authentication with correct credentials no longer fails in this situation. (BZ#1060319)

* Automatically generated default certificates used the SHA-1 algorithm message digest, which is considered insecure. The default certificates now use the more secure SHA-256 algorithm message digest.
(BZ#1135439)

* During the Online Certificate Status Protocol (OCSP) validation, radiusd terminated unexpectedly with a segmentation fault after attempting to access the next update field that was not provided by the OCSP responder. Now, radiusd does not crash in this situation and instead continues to complete the OCSP validation. (BZ#1142669)

* Prior to this update, radiusd failed to work with some of the more recent MikroTIK attributes, because the installed directory.mikrotik file did not include them. This update adds MikroTIK attributes with IDs up to 22 to dictionary.mikrotik, and radiusd now works as expected with these attributes. (BZ#1173388)

Users of freeradius are advised to upgrade to these updated packages, which correct these issues and add these enhancements. After installing this update, the radiusd service will be restarted automatically.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0044 advisory.

    This advisory aggregates security fixes for the freeradius SRPM in CIQ LTS 8.6. It addresses 15 CVEs:
    CVE-2017-10978, CVE-2017-10983, CVE-2017-10986, CVE-2022-41859, CVE-2014-2015, and 10 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated freeradius package fixes security vulnerability :

SSHA processing in freeradius before 2.2.3 runs into a stack-based buffer overflow in the freeradius rlm_pap module if the password source uses an unusually long hashed password (CVE-2014-2015).

Several issues were discovered in FreeRADIUS, a high-performance and highly configurable RADIUS server.

CVE-2014-2015

A stack-based buffer overflow was found in the normify function in the rlm_pap module, which can be attacked by existing users to cause denial of service or other issues.

CVE-2015-4680

It was discovered that freeradius failed to check revocation of intermediate CA certificates, thus accepting client certificates issued by revoked certificates from intermediate CAs.

Note that to enable checking of intermediate CA certificates, it is necessary to enable the check_all_crl option of the EAP TLS section in eap.conf. This is only necessary for servers using certificates signed by intermediate CAs. Servers that use self-signed CAs are unaffected.

CVE-2017-9148

The TLS session cache fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.

For Debian 7 'Wheezy', these problems have been fixed in version 2.1.12+dfsg-1.2+deb7u1.

We recommend that you upgrade your freeradius packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix stack-based buffer overflow flaw in rlm_pap module: long password hashes used by the PAP module can cause a buffer overflow which may terminate the server. fixes bug 1068795, string attributes passed to rlm_perl module were being truncated.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

FreeRadius received a security fix :

A denial of service in rlm_pap hash processing was fixed (CVE-2014-2015 bnc#864576)

It was discovered that FreeRADIUS incorrectly handled unix authentication. A remote user could successfully authenticate with an expired password. (CVE-2011-4966)

Pierre Carrier discovered that FreeRADIUS incorrectly handled rlm_pap hash processing. An authenticated user could use this issue to cause FreeRADIUS to crash, resulting in a denial of service, or possibly execute arbitrary code. The default compiler options for affected releases should reduce the vulnerability to a denial of service.
(CVE-2014-2015).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-1287 advisory.

    [2.2.6-4]
    - Move OpenSSL init out of version check       Resolves: Bug#1189394 radiusd segfaults after update
    - Comment-out ippool-dhcp.conf inclusion       Resolves: Bug#1189386 radiusd fails to start after 'clean' installation

    [2.2.6-3]
    - Disable OpenSSL version check       Resolves: Bug#1189011

    [2.2.6-2]
    - Fix a number of new Coverity errors and compiler warnings.
      Resolves: Bug#1188598

    [2.2.6-1]
    - Upgrade to the latest upstream release v2.2.6       Resolves: Bug#921563  raddebug not working correctly       Resolves: Bug#921567  raddebug -t 0 exists immediately       Resolves: Bug#1060319 MSCHAP Authentication is not working using automatic                             windows user credentials       Resolves: Bug#1078736 Rebase FreeRADIUS to 2.2.4       Resolves: Bug#1135439 Default message digest defaults to sha1       Resolves: Bug#1142669 EAP-TLS and OCSP validation causing segmentation                             fault       Resolves: Bug#1173388 dictionary.mikrotik missing Attributes
    - Remove radutmp rotation       Resolves: Bug#904578  radutmp should not rotate
    - Check for start_servers not exceeding max_servers       Resolves: Bug#1146828 radiusd silently fails when start_servers is higher                             than max_servers

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
85192	Scientific Linux Security Update : freeradius on SL6.x i386/x86_64 (20150722)	Nessus	Scientific Linux Local Security Checks	2015/8/4	2021/1/14	high
85454	Amazon Linux AMI : freeradius (ALAS-2015-581)	Nessus	Amazon Linux Local Security Checks	2015/8/18	2018/4/18	high
354196	Rocky Linux 9.2 [CIQ] Security Update: freeradius / freeradius-debuginfo / freeradius-debugsource / etc Multiple Vulnerabilities (ciqsa-2026_0415)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical
289369	MiracleLinux 4 : freeradius-2.2.6-4.AXS4 (AXSA:2015-304:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
73510	SuSE 11.3 Security Update : freeradius (SAT Patch Number 8968)	Nessus	SuSE Local Security Checks	2014/4/15	2021/1/19	high
76063	GLSA-201406-12 : FreeRADIUS: Arbitrary code execution	Nessus	Gentoo Local Security Checks	2014/6/16	2021/1/6	high
84937	RHEL 6 : freeradius (RHSA-2015:1287)	Nessus	Red Hat Local Security Checks	2015/7/23	2021/2/5	high
359346	Rocky Linux 8.6 [CIQ] Security Update: freeradius / freeradius-debuginfo / freeradius-debugsource / etc Multiple Vulnerabilities (ciqsa-2026_0044)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical
73005	Mandriva Linux Security Advisory : freeradius (MDVSA-2014:058)	Nessus	Mandriva Local Security Checks	2014/3/14	2021/1/6	high
100623	Debian DLA-977-1 : freeradius security update	Nessus	Debian Local Security Checks	2017/6/6	2025/12/17	critical
72887	Fedora 20 : freeradius-3.0.1-4.fc20 (2014-3184)	Nessus	Fedora Local Security Checks	2014/3/10	2021/1/11	high
75280	openSUSE Security Update : freeradius-server (openSUSE-SU-2014:0343-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	high
72719	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.10 : freeradius vulnerabilities (USN-2122-1)	Nessus	Ubuntu Local Security Checks	2014/2/27	2021/1/19	high
85098	Oracle Linux 6 : freeradius (ELSA-2015-1287)	Nessus	Oracle Linux Local Security Checks	2015/7/30	2024/10/22	critical

检测

插件搜索

high

high

critical

critical

high

high

high

critical

high

critical

high

high

high

critical