[Security Announce] [ MDKSA-2007:092 ] - Updated freeradius packages fix vulnerability

Posted by Bob on: 04/23/2007 09:50 PM [ Print | 0 comment(s) ]

The Mandriva Security Team published a new security update for Mandriva Linux. Here the announcement:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDKSA-2007:092
http://www.mandriva.com/security/
_______________________________________________________________________

Package : freeradius
Date : April 23, 2007
Affected: Corporate 4.0
_______________________________________________________________________

Problem Description:

Multiple buffer overflows were found in the FreeRADIUS package version
1.0.4 and prior that could allow a remote attacker to cause a crash
via the rlm_sqlcounter module (CVE-2005-4746).

As well, an SQL injection vulnerability was also found in the
rlm_sqlcounter that could allow a remote attacker to execute arbitrary
SQL commands via unknown attack vectors (CVE-2005-4745).

Updated packages have been patched to correct this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4745
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4746
_______________________________________________________________________

Updated Packages:

Corporate 4.0:
523055be4399355565d6175d7df13ca7 corporate/4.0/i586/freeradius-1.0.4-2.4.20060mlcs4.i586.rpm
4e000a3cb2c8cb2f3359a961878a310a corporate/4.0/i586/libfreeradius1-1.0.4-2.4.20060mlcs4.i586.rpm
3e9f17beada7d6d10235c6db8156a77a corporate/4.0/i586/libfreeradius1-devel-1.0.4-2.4.20060mlcs4.i586.rpm
0429cf3dda93772e358fc34a1d5cb1f8 corporate/4.0/i586/libfreeradius1-krb5-1.0.4-2.4.20060mlcs4.i586.rpm
216c28ffac0b1d03a493d5548556be2d corporate/4.0/i586/libfreeradius1-ldap-1.0.4-2.4.20060mlcs4.i586.rpm
07ebd1dbb7d4f1a71253ebab163f1dd8 corporate/4.0/i586/libfreeradius1-mysql-1.0.4-2.4.20060mlcs4.i586.rpm
9b3586d1c94b6cf650723a095db846d7 corporate/4.0/i586/libfreeradius1-postgresql-1.0.4-2.4.20060mlcs4.i586.rpm
10b8fb70adfc1a641b2f63c041db1069 corporate/4.0/i586/libfreeradius1-unixODBC-1.0.4-2.4.20060mlcs4.i586.rpm
0fb72186b61687df8dedff8d874fbb86 corporate/4.0/SRPMS/freeradius-1.0.4-2.4.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
435d07e3a5878cb0fd27e02fbee702df corporate/4.0/x86_64/freeradius-1.0.4-2.4.20060mlcs4.x86_64.rpm
f57c46977fbd86772852f21d138605de corporate/4.0/x86_64/lib64freeradius1-1.0.4-2.4.20060mlcs4.x86_64.rpm
bcc4dc4cac18ed3d034483de311fe240 corporate/4.0/x86_64/lib64freeradius1-devel-1.0.4-2.4.20060mlcs4.x86_64.rpm
646309915542dad2b6e68ff130fead11 corporate/4.0/x86_64/lib64freeradius1-krb5-1.0.4-2.4.20060mlcs4.x86_64.rpm
039290c0f429ff9f5ecf1ce13b17765f corporate/4.0/x86_64/lib64freeradius1-ldap-1.0.4-2.4.20060mlcs4.x86_64.rpm
0ca4c838dae5657c3f902ed2234a7286 corporate/4.0/x86_64/lib64freeradius1-mysql-1.0.4-2.4.20060mlcs4.x86_64.rpm
a48ad352690163f2fd90f022007bcd7a corporate/4.0/x86_64/lib64freeradius1-postgresql-1.0.4-2.4.20060mlcs4.x86_64.rpm
e8aea2d0c9a45462ef30ab0113b62164 corporate/4.0/x86_64/lib64freeradius1-unixODBC-1.0.4-2.4.20060mlcs4.x86_64.rpm
0fb72186b61687df8dedff8d874fbb86 corporate/4.0/SRPMS/freeradius-1.0.4-2.4.20060mlcs4.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
lt;security*mandriva.comgt;
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFGLO1nmqjQ0CJFipgRAsFaAJ9co3OlDWZ/TbgBhXObcQQisfeV7wCglV83
4mS7Fi8Nr26rU13+J4dlRxM=
=UflY
-----END PGP SIGNATURE-----