CVE-2017-9148 log

Severity High
Remote Yes
Type Authentication bypass
A security issue has been found in FreeRADIUS < 3.0.14. The implementation of TTLS and PEAP in FreeRADIUS skips inner authentication when it handles a resumed TLS connection. This is a feature but there is a critical catch: the server must never allow resumption of a TLS session until its initial connection gets to the point where inner authentication has been finished successfully. Unfortunately, affected versions of FreeRADIUS fail to reliably prevent resumption of unauthenticated sessions unless the TLS session cache is disabled completely and allow an attacker (e.g. a malicious supplicant) to elicit EAP Success without sending any valid credentials.
Group Package Affected Fixed Severity Status Ticket
AVG-281 freeradius 3.0.13-1 3.0.14-3 High Fixed
Date Advisory Group Package Severity Type
02 Jun 2017 ASA-201706-2 AVG-281 freeradius High authentication bypass