FreeRADIUS is the most popular open source RADIUS server and the most widely deployed RADIUS server in the world. It supports all common authentication protocols. It said to be the world’s most popular RADIUS server, is leveraged by many Fortune 500 companies and ISPs.
It is regularly run on Linux systems, it can be configured to work on Windows machines. The protocol enables remote access servers to communicate with a central server to connect and authenticate dial-in users.
The vulnerability (CVE-2017-9148):
“The implementation of TTLS and PEAP in FreeRADIUS skips inner authentication when it handles a resumed TLS connection. This is a feature but there is a critical catch: the server must never allow resumption of a TLS session until its initial connection gets to the point where inner authentication has been finished successfully.”
“Unfortunately, affected versions of FreeRADIUS fail to reliably prevent resumption of unauthenticated sessions unless the TLS session cache is disabled completely and allow an attacker (e.g. a malicious supplicant) to elicit EAP Success without sending any valid credentials.”
Affected Versions:
2.2.x (EOL but still found in some Linux distros): All versions.
3.0.x (stable): All versions before 3.0.14.
3.1.x and 4.0.x (development): All versions before 2017-02-04.
All users recommended upgrading to version 3.0.14 and disable TLS session caching. Set enabled = no in the cache subsection of eap module settings
