Joined: 12 May 2004
|Posted: Tue Apr 04, 2006 7:26 pm Post subject: [ GLSA 200604-03 ] FreeRADIUS: Authentication bypass in EAP-
|Gentoo Linux Security Advisory
Title: FreeRADIUS: Authentication bypass in EAP-MSCHAPv2 module (GLSA 200604-03)
Date: April 04, 2006
The EAP-MSCHAPv2 module of FreeRADIUS is affected by a validation issue which causes some authentication checks to be bypassed.
FreeRADIUS is an open source RADIUS authentication server implementation.
Vulnerable: < 1.1.1
Unaffected: >= 1.1.1
Unaffected: < 1.0.0
Architectures: All supported architectures
FreeRADIUS suffers from insufficient input validation in the EAP-MSCHAPv2 state machine.
An attacker could cause the server to bypass authentication checks by manipulating the EAP-MSCHAPv2 client state machine.
There is no known workaround at this time.
All FreeRADIUS users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=net-dialup/freeradius-1.1.1"
FreeRADIUS Vulnerability Notifications
Last edited by GLSA on Tue Jun 27, 2006 4:18 am; edited 3 times in total