FreeRADIUS disused certificate verification Bypass Vulnerability

Release date:
Updated on:

Affected Systems:
FreeRADIUS 2.1.x
FreeRADIUS 2.0.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 48880
Cve id: CVE-2011-2701

FreeRadius is an open source code verification and account system that uses the RADIUS protocol.

FreeRADIUS has a verification bypass vulnerability in verifying the implementation of obsolete certificates. Remote attackers can exploit this vulnerability to gain unauthorized access to affected servers.

In the test of FreeRADIUS's OCSP support, the FreeRADIUS code resolves the OCSP responder's response to a security vulnerability. If the FreeRADIUS server is configured to use a EAP-TLS for OCSP certificate authentication, this vulnerability allows remote attackers to successfully verify the FreeRADIUS server using obsolete certificates.

<* Source: DFN-CERT

Link: http://www.securityfocus.com/archive/1/518974
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

FreeRADIUS
----------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.freeradius.org/