Bug 135825 (IT_50650) - CAN-2004-0938 Freeradius < 1.0.1 DoS and remote crash (CAN-2004-0960, CAN-2004-0961)
Summary: CAN-2004-0938 Freeradius < 1.0.1 DoS and remote crash (CAN-2004-0960, CAN-200...
Status: CLOSED ERRATA
Alias: IT_50650
Product: Red Hat Enterprise Linux 3
Classification: Red Hat
Component: freeradius   
(Show other bugs)
Version: 3.0
Hardware: All Linux
medium
high
Target Milestone: ---
Assignee: Thomas Woerner
QA Contact:
URL:
Whiteboard: impact=important,public=20040902
Keywords: Security
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2004-10-15 09:51 UTC by Bastien Nocera
Modified: 2007-11-30 22:07 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2004-11-12 16:42:49 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2004:609 high SHIPPED_LIVE Moderate: freeradius security update 2004-11-12 05:00:00 UTC

Description Bastien Nocera 2004-10-15 09:51:27 UTC
Description of problem:
Remote Denial Of Service, and remote crash by sending malformed packets.

Version-Release number of selected component (if applicable):
All version of Freeradius prior to version 1.0.1 (to check)

From the freeradius ChangeLog:
FreeRADIUS 1.0.1 ; $Date: 2004/09/02 10:52:03 $, urgency=high
	Denial-of-Service Security Fix
	* Fix two remote crashes and a memory leak in RADIUS packet
	  decoding.

No CAN numbers have been associated with this issue:
http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=freeradius

Comment 1 Mark J. Cox 2004-10-15 10:00:12 UTC
http://www.kb.cert.org/vuls/id/541574
http://secunia.com/advisories/12570/

Removing security-sensitive tag as this issue is public.

Comment 2 Mark J. Cox 2004-10-18 15:10:19 UTC
RHSA-2004:609 in progress which will update FreeRADIUS to version
1.0.1 and also fix:

127168 - rebuilding freeradius picks up system libeap rather than
package libeap
127162 - zlib-devel is missing from BuildRequires in spec file
130606 - Missing buildrequires in freediag
130613 - radiusd.conf specifies other pam-auth than file installed in
/etc/pam.d


Comment 3 Mark J. Cox 2004-10-19 07:51:39 UTC
CAN-2004-0938, CAN-2004-0960, CAN-2004-0961 were assigned to these issues

Comment 4 Josh Bressers 2004-11-12 16:42:49 UTC
An errata has been issued which should help the problem 
described in this bug report. This report is therefore being 
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files, 
please follow the link below. You may reopen this bug report 
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2004-609.html



Note You need to log in before you can comment on or make changes to this bug.