CVE-2015-4680 Security feature bypass in n/a
FreeRADIUS fails to properly check revocation of intermediate CA certificates, allowing attackers to bypass certificate validation security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-4680?
CVE-2015-4680 is a high-severity vulnerability in Suse Linux Enterprise Server, published on 5 Apr 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.
Weakness: CWE-295
Which versions are affected by CVE-2015-4680?
It affects 3 products.
Linux distribution packages (7)
freeradius-server SUSE:Linux Enterprise Server 12 SP1 | All versions | 3.0.3-14.1 |
freeradius-server SUSE:Linux Enterprise Server 12 SP2 | All versions | 3.0.3-14.1 |
freeradius-server SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | All versions | 3.0.3-14.1 |
freeradius-server SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 3.0.3-14.1 |
freeradius-server SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 3.0.3-14.1 |
freeradius-server SUSE:Linux Enterprise Software Development Kit 12 SP1 | All versions | 3.0.3-14.1 |
freeradius-server SUSE:Linux Enterprise Software Development Kit 12 SP2 | All versions | 3.0.3-14.1 |
Products include Freeradius Freeradius, Suse Linux Enterprise Server, Suse Linux Enterprise Software Development Kit.
How do I fix CVE-2015-4680?
Upgrade to a fixed version.
Is CVE-2015-4680 being exploited?
There is no known exploitation of CVE-2015-4680 in the wild and no public exploit code.
Other vulnerabilities in Suse Linux Enterprise Server
Sources
Also known as DEBIAN-CVE-2015-4680, GHSA-58q5-m5pm-jwpv, MGASA-2015-0291, SUSE-SU-2017:0102-1.