Freeradius Freeradius

Do you want an email whenever new security vulnerabilities are reported in any Freeradius product?

Products by Freeradius Sorted by Most Security Vulnerabilities since 2018

Freeradius10 vulnerabilities

Freeradius Pam Radius1 vulnerability

By the Year

In 2024 there have been 0 vulnerabilities in Freeradius . Last year Freeradius had 3 security vulnerabilities published. Right now, Freeradius is on track to have less security vulnerabilities in 2024 than it did last year.

Year Vulnerabilities Average Score
2024 0 0.00
2023 3 7.17
2022 0 0.00
2021 0 0.00
2020 2 7.50
2019 3 8.87
2018 0 0.00

It may take a day or so for new Freeradius vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Freeradius Security Vulnerabilities

A flaw was found in freeradius

CVE-2022-41861 6.5 - Medium - January 17, 2023

A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash.

Improper Input Validation

In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look

CVE-2022-41860 7.5 - High - January 17, 2023

In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the server to crash.

NULL Pointer Dereference

In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which

CVE-2022-41859 7.5 - High - January 17, 2023

In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.

Insufficiently Protected Credentials

In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes

CVE-2019-17185 7.5 - High - March 21, 2020

In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack.

Improper Synchronization

add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password

CVE-2015-9542 7.5 - High - February 24, 2020

add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a crafted password to an application (loading the pam_radius library) and crash it. Arbitrary code execution might be possible, depending on the application, C library, compiler, and other factors.

Memory Corruption

It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate

CVE-2019-10143 7 - High - May 24, 2019

It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user. NOTE: the upstream software maintainer has stated "there is simply no way for anyone to gain privileges through this alleged issue."

Execution with Unnecessary Privileges

FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing

CVE-2019-11234 9.8 - Critical - April 22, 2019

FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497.

authentification

FreeRADIUS before 3.0.19 mishandles the "each participant verifies

CVE-2019-11235 9.8 - Critical - April 22, 2019

FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.

Insufficient Verification of Data Authenticity

The fr_dhcp_decode function in lib/dhcp.c in FreeRADIUS 2.1.9, in certain non-default builds, does not properly handle the DHCP Relay Agent Information option, which allows remote attackers to cause a denial of service (infinite loop and daemon outage) via a packet

CVE-2010-3696 - October 07, 2010

The fr_dhcp_decode function in lib/dhcp.c in FreeRADIUS 2.1.9, in certain non-default builds, does not properly handle the DHCP Relay Agent Information option, which allows remote attackers to cause a denial of service (infinite loop and daemon outage) via a packet that has more than one sub-option. NOTE: some of these details are obtained from third party information.

Resource Management Errors

Buffer overflow in the SMB_Connect_Server function in FreeRadius 1.1.3 and earlier

CVE-2007-0080 - January 05, 2007

Buffer overflow in the SMB_Connect_Server function in FreeRadius 1.1.3 and earlier allows attackers to execute arbitrary code related to the server desthost field of an SMB_Handle_Type instance. NOTE: the impact of this issue has been disputed by a reliable third party and the vendor, who states that exploitation is limited "only to local administrators who have write access to the server configuration files." CVE concurs with the dispute

Buffer Overflow

Off-by-one error in the sql_error function in sql_unixodbc.c in FreeRADIUS 1.0.2.5-5, and possibly other versions including 1.0.4, might

CVE-2005-4744 - December 31, 2005

Off-by-one error in the sql_error function in sql_unixodbc.c in FreeRADIUS 1.0.2.5-5, and possibly other versions including 1.0.4, might allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by causing the external database query to fail. NOTE: this single issue is part of a larger-scale disclosure, originally by SUSE, which reported multiple issues that were disputed by FreeRADIUS. Disputed issues included file descriptor leaks, memory disclosure, LDAP injection, and other issues. Without additional information, the most recent FreeRADIUS report is being regarded as the authoritative source for this CVE identifier.

Built by Foundeo Inc., with data from the National Vulnerability Database (NVD), Icons by Icons8. Privacy Policy. Use of this site is governed by the Legal Terms
Disclaimer
CONTENT ON THIS WEBSITE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. Always check with your vendor for the most up to date, and accurate information.