p PatchFirst

CVE-2019-10143

CVE-2019-10143

This page contains facts from public vulnerability sources. Check the original advisory before updating.

It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user. NOTE: the upstream software maintainer has stated "there is simply no way for anyone to gain privileges through this alleged issue."

CVSS 6.4 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • freeradius

    Versions
    • affects <= 3.0.19: Affected

    No fix published

  • freeradius Debian:12

    Versions
    • 3.2.1+dfsg-4
    • 3.2.1+dfsg-4+deb12u1
    • 3.2.10+dfsg-1
    • 3.2.10+dfsg-2
    • 3.2.2+dfsg-1~exp1
    • 3.2.3+dfsg-1
    • 3.2.3+dfsg-2
    • 3.2.5+dfsg-1
    • 3.2.5+dfsg-2
    • 3.2.5+dfsg-3
    • 3.2.6+dfsg-1
    • 3.2.6+dfsg-2
    • 3.2.6+dfsg-2~bpo12+1
    • 3.2.6+dfsg-3
    • 3.2.7+dfsg-1
    • 3.2.7+dfsg-1~bpo12+1
    • 3.2.7+dfsg-2
    • 3.2.8+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • freeradius Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.2.6+dfsg-3

    Update to 3.2.6+dfsg-3

  • freeradius Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.2.6+dfsg-3

    Update to 3.2.6+dfsg-3

  • freeradius Ubuntu:Pro:16.04:LTS

    Versions
    • 2.1.12+dfsg-1.3ubuntu5
    • 2.2.8+dfsg-0.1
    • 2.2.8+dfsg-0.1build1
    • 2.2.8+dfsg-0.1build2
    • 2.2.8+dfsg-0.1ubuntu0.1
    • 2.2.8+dfsg-0.1ubuntu0.1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • freeradius Ubuntu:18.04:LTS

    Versions
    • 3.0.15+dfsg-1ubuntu2
    • 3.0.16+dfsg-1ubuntu2
    • 3.0.16+dfsg-1ubuntu3
    • 3.0.16+dfsg-1ubuntu3.1
    • 3.0.16+dfsg-1ubuntu3.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • freeradius Ubuntu:20.04:LTS

    Versions
    • 3.0.19+dfsg-3
    • 3.0.19+dfsg-3build1
    • 3.0.20+dfsg-1
    • 3.0.20+dfsg-3
    • 3.0.20+dfsg-3build1
    • 3.0.20+dfsg-3ubuntu0.1
    • 3.0.20+dfsg-3ubuntu0.2
    • 3.0.20+dfsg-3ubuntu0.4
    • 3.0.20+dfsg-3ubuntu0.5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • freeradius Ubuntu:22.04:LTS

    Versions
    • 3.0.21+dfsg-2.2
    • 3.0.21+dfsg-3
    • 3.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu2
    • 3.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu3
    • 3.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu3.1
    • 3.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu3.2
    • 3.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu3.3
    • 3.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu3.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • freeradius Ubuntu:24.04:LTS

    Versions
    • 3.2.3+dfsg-2
    • 3.2.3+dfsg-2build2
    • 3.2.3+dfsg-2build6
    • 3.2.3+dfsg-2build7
    • 3.2.5+dfsg-3~ubuntu24.04.1
    • 3.2.5+dfsg-3~ubuntu24.04.2
    • 3.2.5+dfsg-3~ubuntu24.04.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • freeradius Ubuntu:25.10

    Versions
    • 3.2.7+dfsg-1ubuntu1
    • 3.2.7+dfsg-1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • freeradius Ubuntu:26.10

    Versions
    • 3.2.8+dfsg-1ubuntu2
    • 3.2.8+dfsg-1ubuntu4
    • 3.2.10+dfsg-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • freeradius Ubuntu:26.04:LTS

    Versions
    • 3.2.7+dfsg-1ubuntu2
    • 3.2.8+dfsg-1ubuntu1
    • 3.2.8+dfsg-1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →