FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

pyrad -- multiple vulnerabilities

Affected packages
	py310-pyrad	<	2.1
	py36-pyrad	<	2.1
	py37-pyrad	<	2.1
	py38-pyrad	<	2.1
	py39-pyrad	<	2.1

Details

VuXML ID	17702e54-3da0-11ec-b7e0-3085a9a95629
Discovery	2013-01-15
Entry	2021-11-05

Nathaniel McCallum reports:

packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack.

[source]

The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packets by predicting the next ID, a different vulnerability than CVE-2013-0294.

[source]

References

CVE Name	CVE-2013-0294
CVE Name	CVE-2013-0342
URL	https://bugzilla.redhat.com/show_bug.cgi?id=911682
URL	https://bugzilla.redhat.com/show_bug.cgi?id=911685