[ MDKSA-2007:092 ] - Updated freeradius packages fix vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2007:092
http://www.mandriva.com/security/
_______________________________________________________________________
Package : freeradius
Date : April 23, 2007
Affected: Corporate 4.0
_______________________________________________________________________
Problem Description:
Multiple buffer overflows were found in the FreeRADIUS package version
1.0.4 and prior that could allow a remote attacker to cause a crash
via the rlm_sqlcounter module (CVE-2005-4746).
As well, an SQL injection vulnerability was also found in the
rlm_sqlcounter that could allow a remote attacker to execute arbitrary
SQL commands via unknown attack vectors (CVE-2005-4745).
Updated packages have been patched to correct this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4745
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4746
_______________________________________________________________________
Updated Packages:
Corporate 4.0:
523055be4399355565d6175d7df13ca7
corporate/4.0/i586/freeradius-1.0.4-2.4.20060mlcs4.i586.rpm
4e000a3cb2c8cb2f3359a961878a310a
corporate/4.0/i586/libfreeradius1-1.0.4-2.4.20060mlcs4.i586.rpm
3e9f17beada7d6d10235c6db8156a77a
corporate/4.0/i586/libfreeradius1-devel-1.0.4-2.4.20060mlcs4.i586.rpm
0429cf3dda93772e358fc34a1d5cb1f8
corporate/4.0/i586/libfreeradius1-krb5-1.0.4-2.4.20060mlcs4.i586.rpm
216c28ffac0b1d03a493d5548556be2d
corporate/4.0/i586/libfreeradius1-ldap-1.0.4-2.4.20060mlcs4.i586.rpm
07ebd1dbb7d4f1a71253ebab163f1dd8
corporate/4.0/i586/libfreeradius1-mysql-1.0.4-2.4.20060mlcs4.i586.rpm
9b3586d1c94b6cf650723a095db846d7
corporate/4.0/i586/libfreeradius1-postgresql-1.0.4-2.4.20060mlcs4.i586.rpm
10b8fb70adfc1a641b2f63c041db1069
corporate/4.0/i586/libfreeradius1-unixODBC-1.0.4-2.4.20060mlcs4.i586.rpm
0fb72186b61687df8dedff8d874fbb86
corporate/4.0/SRPMS/freeradius-1.0.4-2.4.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
435d07e3a5878cb0fd27e02fbee702df
corporate/4.0/x86_64/freeradius-1.0.4-2.4.20060mlcs4.x86_64.rpm
f57c46977fbd86772852f21d138605de
corporate/4.0/x86_64/lib64freeradius1-1.0.4-2.4.20060mlcs4.x86_64.rpm
bcc4dc4cac18ed3d034483de311fe240
corporate/4.0/x86_64/lib64freeradius1-devel-1.0.4-2.4.20060mlcs4.x86_64.rpm
646309915542dad2b6e68ff130fead11
corporate/4.0/x86_64/lib64freeradius1-krb5-1.0.4-2.4.20060mlcs4.x86_64.rpm
039290c0f429ff9f5ecf1ce13b17765f
corporate/4.0/x86_64/lib64freeradius1-ldap-1.0.4-2.4.20060mlcs4.x86_64.rpm
0ca4c838dae5657c3f902ed2234a7286
corporate/4.0/x86_64/lib64freeradius1-mysql-1.0.4-2.4.20060mlcs4.x86_64.rpm
a48ad352690163f2fd90f022007bcd7a
corporate/4.0/x86_64/lib64freeradius1-postgresql-1.0.4-2.4.20060mlcs4.x86_64.rpm
e8aea2d0c9a45462ef30ab0113b62164
corporate/4.0/x86_64/lib64freeradius1-unixODBC-1.0.4-2.4.20060mlcs4.x86_64.rpm
0fb72186b61687df8dedff8d874fbb86
corporate/4.0/SRPMS/freeradius-1.0.4-2.4.20060mlcs4.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
iD8DBQFGLO1nmqjQ0CJFipgRAsFaAJ9co3OlDWZ/TbgBhXObcQQisfeV7wCglV83
4mS7Fi8Nr26rU13+J4dlRxM=
=UflY
-----END PGP SIGNATURE-----