Description
The ocsp_check function in rlm_eap_tls.c in FreeRADIUS 2.1.11, when OCSP is enabled, does not properly parse replies from OCSP responders, which allows remote attackers to bypass authentication by using the EAP-TLS protocol with a revoked X.509 client certificate.
References
- 48880 vdb-entry
- freeradius-certificate-security-bypass(68782) vdb-entry
- [oss-security] 20110715 CVE request: vulnerability in FreeRADIUS (OCSP) mailing-list
- [oss-security] 20110718 Re: CVE request: vulnerability in FreeRADIUS (OCSP) mailing-list
- 45425 third-party-advisory
- 20110725 [DSB-2011-01] Security Advisory FreeRADIUS 2.1.11 mailing-list
- https://www.dfn-cert.de/informationen/Sicherheitsbulletins/dsb-2011-01.html
- 8325 third-party-advisory
- 1025833 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=724815
- [oss-security] 20110720 Re: CVE request: vulnerability in FreeRADIUS (OCSP) mailing-list