NVD Vulnerability Detail

CVE-2011-2701

Summary	The ocsp_check function in rlm_eap_tls.c in FreeRADIUS 2.1.11, when OCSP is enabled, does not properly parse replies from OCSP responders, which allows remote attackers to bypass authentication by using the EAP-TLS protocol with a revoked X.509 client certificate.
Publication Date	Aug. 4, 2011, 11:45 a.m.
Registration Date	Jan. 28, 2021, 4:39 p.m.
Last Update	Nov. 21, 2024, 10:28 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:freeradius:freeradius:2.1.11:::::::*

Related information, measures and tools

No	URL	タグ
1	http://secunia.com/advisories/45425	Vendor Advisory
2	http://securityreason.com/securityalert/8325
3	http://securitytracker.com/id?1025833
4	http://www.openwall.com/lists/oss-security/2011/07/15/6
5	http://www.openwall.com/lists/oss-security/2011/07/18/2
6	http://www.openwall.com/lists/oss-security/2011/07/20/9
7	http://www.securityfocus.com/archive/1/518974/100/0/threaded
8	http://www.securityfocus.com/bid/48880
9	https://bugzilla.redhat.com/show_bug.cgi?id=724815	Patch
10	https://exchange.xforce.ibmcloud.com/vulnerabilities/68782
11	https://www.dfn-cert.de/informationen/Sicherheitsbulletins/dsb-2011-01.html
12	http://secunia.com/advisories/45425	Vendor Advisory
13	https://www.dfn-cert.de/informationen/Sicherheitsbulletins/dsb-2011-01.html
14	https://exchange.xforce.ibmcloud.com/vulnerabilities/68782
15	https://bugzilla.redhat.com/show_bug.cgi?id=724815	Patch
16	http://www.securityfocus.com/bid/48880
17	http://www.securityfocus.com/archive/1/518974/100/0/threaded
18	http://www.openwall.com/lists/oss-security/2011/07/20/9
19	http://www.openwall.com/lists/oss-security/2011/07/18/2
20	http://www.openwall.com/lists/oss-security/2011/07/15/6
21	http://securitytracker.com/id?1025833
22	http://securityreason.com/securityalert/8325

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-287	不適切な認証	https://cwe.mitre.org/data/definitions/287.html

JVN Vulnerability Information

FreeRADIUS の ocsp_check 関数における認証を回避される脆弱性

Title	FreeRADIUS の ocsp_check 関数における認証を回避される脆弱性
Summary	FreeRADIUS の rlm_eap_tls.c のocsp_check 関数は、OCSP が有効にされた際、OCSP レスポンダーからの返信を適切に解析しないため、認証を回避される脆弱性が存在します。
Possible impacts	第三者により、廃止された .X509 クライアントの証明書付きの EAP-TLS プロトコルが使用されることで、認証を回避される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Aug. 3, 2011, midnight
Registration Date	March 27, 2012, 6:43 p.m.
Last Update	March 27, 2012, 6:43 p.m.

Affected System

FreeRADIUS

FreeRADIUS 2.1.11

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-2701	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2701
National Vulnerability Database (NVD)
2	CVE-2011-2701	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2701

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-287	https://jvndb.jvn.jp/ja/cwe/CWE-287.html

ベンダー情報

No	Name	URL
FreeRADIUS
1	Top Page	http://freeradius.org/

Change Log

No	Changed Details	Date of change
0	[2012年03月27日] 掲載	Feb. 17, 2018, 10:37 a.m.