CVE-2017-9148
CriticalSummary
The TLS session cache in FreeRADIUS from versions 2.1.1 to 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 has a problem with reliably preventing the resumption of an unauthenticated session. This allows remote attackers, such as malicious 802.1X supplicants, to bypass authentication via PEAP or TTLS.
Risk Assessment
The organization is at risk of unauthorized access to resources, which can lead to serious security breaches. Attackers may exploit this vulnerability to hijack user sessions.
Recommendation
It is recommended to update FreeRADIUS to version 3.0.14 or later, 3.1.x after 2017-02-04, or 4.0.x after 2017-02-04 to mitigate this vulnerability. Additionally, consider implementing extra security mechanisms for TLS sessions.
Original NVD description (English source)
The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.