Vulnerability Name:

CVE-2006-1354 (CCN-25352)

Assigned:2006-03-20
Published:2006-03-20
Updated:2017-10-11
Summary:Unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass authentication or cause a denial of service (server crash) via "Insufficient input validation" in the EAP-MSCHAPv2 state machine module.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Bypass Security
References:Source: SGI
Type: UNKNOWN
20060404-01-U

Source: MITRE
Type: CNA
CVE-2006-1354

Source: SUSE
Type: UNKNOWN
SUSE-SA:2006:019

Source: CCN
Type: RHSA-2006-0271
freeradius security update

Source: REDHAT
Type: UNKNOWN
RHSA-2006:0271

Source: CCN
Type: SA19300
FreeRADIUS EAP-MSCHAPv2 Authentication Bypass Vulnerability

Source: SECUNIA
Type: Patch, Vendor Advisory
19300

Source: SECUNIA
Type: UNKNOWN
19405

Source: SECUNIA
Type: UNKNOWN
19518

Source: SECUNIA
Type: UNKNOWN
19527

Source: SECUNIA
Type: UNKNOWN
19811

Source: SECUNIA
Type: UNKNOWN
20461

Source: CCN
Type: SECTRACK ID: 1015795
FreeRADIUS Input Validation Error in EAP-MSCHAPv2 Module May Let Remote Users Bypass Authentication

Source: SECTRACK
Type: UNKNOWN
1015795

Source: CCN
Type: ASA-2006-100
freeradius security update (RHSA-2006-0271)

Source: DEBIAN
Type: UNKNOWN
DSA-1089

Source: DEBIAN
Type: DSA-1089
freeradius -- several vulnerabilities

Source: CCN
Type: FreeRADIUS Web site
Security Contacts and notifications

Source: CONFIRM
Type: UNKNOWN
http://www.freeradius.org/security.html

Source: CCN
Type: GLSA-200604-03
FreeRADIUS: Authentication bypass in EAP-MSCHAPv2 module

Source: GENTOO
Type: UNKNOWN
GLSA-200604-03

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2006:060

Source: BID
Type: UNKNOWN
17171

Source: CCN
Type: BID-17171
FreeRADIUS EAP-MSCHAPv2 Authentication Bypass Vulnerability

Source: TRUSTIX
Type: UNKNOWN
2006-0020

Source: VUPEN
Type: UNKNOWN
ADV-2006-1016

Source: XF
Type: UNKNOWN
freeradius-eap-mschapv2-auth-bypass(25352)

Source: XF
Type: UNKNOWN
freeradius-eap-mschapv2-auth-bypass(25352)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:10156

Source: SUSE
Type: SUSE-SA:2006:019
freeradius authentication bypass

Vulnerable Configuration:Configuration 1:
  • cpe:/a:freeradius:freeradius:1.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:freeradius:freeradius:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:freeradius:freeradius:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:freeradius:freeradius:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:freeradius:freeradius:1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:freeradius:freeradius:1.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:freeradius:freeradius:1.1.0:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:4:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20061354
    V
    		CVE-2006-1354
    2015-11-16
    oval:org.mitre.oval:def:10156
    V
    		Unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass authentication or cause a denial of service (server crash) via "Insufficient input validation" in the EAP-MSCHAPv2 state machine module.
    2013-04-29
    oval:org.debian:def:1089
    V
    		several vulnerabilities
    2006-06-03
    oval:com.redhat.rhsa:def:20060271
    P
    		RHSA-2006:0271: freeradius security update (Important)
    2006-04-13
    BACK
    freeradius freeradius 1.0.0
    freeradius freeradius 1.0.1
    freeradius freeradius 1.0.2
    freeradius freeradius 1.0.3
    freeradius freeradius 1.0.4
    freeradius freeradius 1.0.5
    freeradius freeradius 1.1.0