Read the docs
TI-2011-04274 Aliases CVE-2011-4966GHSA-3gjj-f2w8-w88q

modules/rlm_unix/rlm_unix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for…

Priority LOW 30CWE-255Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Partial Red Hat: 6 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

modules/rlm_unix/rlm_unix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the password expiration in /etc/shadow, which allows remote authenticated users to authenticate using an expired password.

Why it matters now

EPSS 0.01382 72nd percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 6 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 49

CPEVersionsRoleVendor
cpe:2.3:a:freeradius:freeradius:*:*:*:*:*:*:*:*all versions; up to 2.2.0Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:0.1:*:*:*:*:*:*:*0.1Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:0.2:*:*:*:*:*:*:*0.2Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:0.3:*:*:*:*:*:*:*0.3Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:0.4:*:*:*:*:*:*:*0.4Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:0.5:*:*:*:*:*:*:*0.5Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:0.6:*:*:*:*:*:*:*0.6Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:0.7:*:*:*:*:*:*:*0.7Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:0.7.1:*:*:*:*:*:*:*0.7.1Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:0.8:*:*:*:*:*:*:*0.8Vulnerablefreeradius
  • cpe:2.3:a:freeradius:freeradius:*:*:*:*:*:*:*:* Versions all versions; up to 2.2.0 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:0.1:*:*:*:*:*:*:* Versions 0.1 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:0.2:*:*:*:*:*:*:* Versions 0.2 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:0.3:*:*:*:*:*:*:* Versions 0.3 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:0.4:*:*:*:*:*:*:* Versions 0.4 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:0.5:*:*:*:*:*:*:* Versions 0.5 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:0.6:*:*:*:*:*:*:* Versions 0.6 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:0.7:*:*:*:*:*:*:* Versions 0.7 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:0.7.1:*:*:*:*:*:*:* Versions 0.7.1 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:0.8:*:*:*:*:*:*:* Versions 0.8 Vulnerable ·freeradius
Show 39 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:freeradius:freeradius:0.8.1:*:*:*:*:*:*:*0.8.1Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:0.9:*:*:*:*:*:*:*0.9Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:0.9.0:*:*:*:*:*:*:*0.9.0Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:0.9.1:*:*:*:*:*:*:*0.9.1Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:0.9.2:*:*:*:*:*:*:*0.9.2Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:0.9.3:*:*:*:*:*:*:*0.9.3Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:1.0.0:*:*:*:*:*:*:*1.0.0Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:1.0.1:*:*:*:*:*:*:*1.0.1Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:1.0.2:*:*:*:*:*:*:*1.0.2Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:1.0.3:*:*:*:*:*:*:*1.0.3Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:1.0.4:*:*:*:*:*:*:*1.0.4Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:1.0.5:*:*:*:*:*:*:*1.0.5Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:1.1.0:*:*:*:*:*:*:*1.1.0Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:1.1.1:*:*:*:*:*:*:*1.1.1Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:1.1.2:*:*:*:*:*:*:*1.1.2Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:1.1.3:*:*:*:*:*:*:*1.1.3Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:1.1.4:*:*:*:*:*:*:*1.1.4Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:1.1.5:*:*:*:*:*:*:*1.1.5Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:1.1.6:*:*:*:*:*:*:*1.1.6Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:1.1.7:*:*:*:*:*:*:*1.1.7Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:1.1.8:*:*:*:*:*:*:*1.1.8Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:2.0:*:*:*:*:*:*:*2.0Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:2.0.1:*:*:*:*:*:*:*2.0.1Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:2.0.2:*:*:*:*:*:*:*2.0.2Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:2.0.3:*:*:*:*:*:*:*2.0.3Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:2.0.4:*:*:*:*:*:*:*2.0.4Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:2.0.5:*:*:*:*:*:*:*2.0.5Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:2.1.0:*:*:*:*:*:*:*2.1.0Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:2.1.1:*:*:*:*:*:*:*2.1.1Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:2.1.2:*:*:*:*:*:*:*2.1.2Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:2.1.3:*:*:*:*:*:*:*2.1.3Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:2.1.4:*:*:*:*:*:*:*2.1.4Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:2.1.6:*:*:*:*:*:*:*2.1.6Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:2.1.7:*:*:*:*:*:*:*2.1.7Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:2.1.8:*:*:*:*:*:*:*2.1.8Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:2.1.9:*:*:*:*:*:*:*2.1.9Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:2.1.10:*:*:*:*:*:*:*2.1.10Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:2.1.11:*:*:*:*:*:*:*2.1.11Vulnerablefreeradius
cpe:2.3:a:freeradius:freeradius:2.1.12:*:*:*:*:*:*:*2.1.12Vulnerablefreeradius
  • cpe:2.3:a:freeradius:freeradius:0.8.1:*:*:*:*:*:*:* Versions 0.8.1 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:0.9:*:*:*:*:*:*:* Versions 0.9 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:0.9.0:*:*:*:*:*:*:* Versions 0.9.0 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:0.9.1:*:*:*:*:*:*:* Versions 0.9.1 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:0.9.2:*:*:*:*:*:*:* Versions 0.9.2 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:0.9.3:*:*:*:*:*:*:* Versions 0.9.3 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:1.0.4:*:*:*:*:*:*:* Versions 1.0.4 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:1.0.5:*:*:*:*:*:*:* Versions 1.0.5 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:1.1.0:*:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:1.1.2:*:*:*:*:*:*:* Versions 1.1.2 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:1.1.3:*:*:*:*:*:*:* Versions 1.1.3 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:1.1.4:*:*:*:*:*:*:* Versions 1.1.4 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:1.1.5:*:*:*:*:*:*:* Versions 1.1.5 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:1.1.6:*:*:*:*:*:*:* Versions 1.1.6 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:1.1.7:*:*:*:*:*:*:* Versions 1.1.7 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:1.1.8:*:*:*:*:*:*:* Versions 1.1.8 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:2.0.3:*:*:*:*:*:*:* Versions 2.0.3 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:2.0.4:*:*:*:*:*:*:* Versions 2.0.4 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:2.0.5:*:*:*:*:*:*:* Versions 2.0.5 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:2.1.3:*:*:*:*:*:*:* Versions 2.1.3 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:2.1.4:*:*:*:*:*:*:* Versions 2.1.4 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:2.1.6:*:*:*:*:*:*:* Versions 2.1.6 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:2.1.7:*:*:*:*:*:*:* Versions 2.1.7 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:2.1.8:*:*:*:*:*:*:* Versions 2.1.8 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:2.1.9:*:*:*:*:*:*:* Versions 2.1.9 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:2.1.10:*:*:*:*:*:*:* Versions 2.1.10 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:2.1.11:*:*:*:*:*:*:* Versions 2.1.11 Vulnerable ·freeradius
  • cpe:2.3:a:freeradius:freeradius:2.1.12:*:*:*:*:*:*:* Versions 2.1.12 Vulnerable ·freeradius

Remediation

Red Hat 1 advisory

  • RHSA-2013:0134 Released 2013-01-08 · Red Hat rating Low
    freeradius2 security and bug fix update
    • Red Hat Enterprise Linux (v. 5 server) freeradius2-2.1.12-5.el5, freeradius2-2.1.12-5.el5.i386, freeradius2-2.1.12-5.el5.ia64 +33
    • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) freeradius2-2.1.12-5.el5, freeradius2-2.1.12-5.el5.i386, freeradius2-krb5-2.1.12-5.el5 +15

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2013:0134
Red Hat Enterprise Linux Desktop Workstation (v. 5 client)Fixed RHSA-2013:0134
Red Hat Enterprise Linux Server (v. 6)Fixed—
Red Hat Enterprise Linux Server Optional (v. 6)Fixed—
Red Hat Enterprise Linux Workstation (v. 6)Fixed—
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed—

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-4966
  2. 2026-10-03 Alias added: GHSA-3gjj-f2w8-w88q

References

Patch 1

Advisory 2

Other 2

  • TI-2019-07466 Race condition in freeradius CVSS 3.1HIGH 7.0
  • TI-2024-03351 RADIUS Protocol under RFC2865 is vulnerable to forgery attacks. CVSS 3.1CRITICAL 9.0
  • TI-2019-08409 FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing… CVSS 3.0CRITICAL 9.8
  • TI-2017-08061 An FR-GV-202 issue in FreeRADIUS 2.x before 2.2.10 allows "Write overflow in… CVSS 3.0CRITICAL 9.8
  • TI-2017-08066 An FR-GV-301 issue in FreeRADIUS 3.x before 3.0.15 allows "Write overflow in… CVSS 3.0CRITICAL 9.8
  • TI-2017-06599 The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x… CVSS 3.0CRITICAL 9.8
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences