Subject: [ASA-201706-2] freeradius: authentication bypass

Arch Linux Security Advisory ASA-201706-2
=========================================

Severity: High
Date    : 2017-06-02
CVE-ID  : CVE-2017-9148
Package : freeradius
Type    : authentication bypass
Remote  : Yes
Link    : https://security.archlinux.org/AVG-281

Summary
=======

The package freeradius before version 3.0.14-3 is vulnerable to
authentication bypass.

Resolution
==========

Upgrade to 3.0.14-3.

# pacman -Syu "freeradius>=3.0.14-3"

The problem has been fixed upstream in version 3.0.14.

Workaround
==========

None.

Description
===========

A security issue has been found in FreeRADIUS < 3.0.14. The
implementation of TTLS and PEAP in FreeRADIUS skips inner
authentication when it handles a resumed TLS connection. This is a
feature but there is a critical catch: the server must never allow
resumption of a TLS session until its initial connection gets to the
point where inner authentication has been finished successfully.
Unfortunately, affected versions of FreeRADIUS fail to reliably prevent
resumption of unauthenticated sessions unless the TLS session cache is
disabled completely and allow an attacker (e.g. a malicious supplicant)
to elicit EAP Success without sending any valid credentials.

Impact
======

A remote user can bypass authentication by starting then resuming an
unauthenticated TLS session.

References
==========

http://freeradius.org/press/index.html#3.0.14
http://seclists.org/oss-sec/2017/q2/342
https://security.archlinux.org/CVE-2017-9148