[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[oCERT-2015-008] FreeRADIUS insufficent CRL application
#2015-008 FreeRADIUS insufficent CRL application
The FreeRADIUS server is an open source project that provides a RADIUS
The FreeRADIUS server relies on OpenSSL to perform certificate validation,
including Certificate Revocation List (CRL) checks. The FreeRADIUS usage of
OpenSSL, in CRL application, limits the checks to leaf certificates,
therefore not detecting revocation of intermediate CA certificates.
An unexpired client certificate, issued by an intermediate CA with a revoked
certificate, is therefore accepted by FreeRADIUS.
Specifically sets the X509_V_FLAG_CRL_CHECK flag for leaf certificate CRL
checks, but does not use X509_V_FLAG_CRL_CHECK_ALL for CRL checks on the
complete trust chain.
The FreeRADIUS project advises that the recommended configuration is to use
self-signed CAs for all EAP-TLS methods.
FreeRADIUS <= 2.2.7, <= 3.0.8
FreeRADIUS >= 2.2.8, >= 3.0.9
Credit: vulnerability anonymously reported.
2015-06-17: vulnerability report received
2015-06-18: contacted FreeRADIUS security maintainer
2015-06-18: patch provided by maintainer
2015-06-19: assigned CVE
2015-06-22: advisory release
Andrea Barisani | Founder & Project Coordinator
oCERT | OSS Computer Security Incident Response Team
0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E
"Pluralitas non est ponenda sine necessitate"