Bug 135825 - (IT_50650) CAN-2004-0938 Freeradius < 1.0.1 DoS and remote crash (CAN-2004-0960, CAN-2004-0961)
CAN-2004-0938 Freeradius < 1.0.1 DoS and remote crash (CAN-2004-0960, CAN-200...
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 3
Classification: Red Hat
Component: freeradius (Show other bugs)
3.0
All Linux
medium Severity high
: ---
: ---
Assigned To: Thomas Woerner
impact=important,public=20040902
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2004-10-15 05:51 EDT by Bastien Nocera
Modified: 2007-11-30 17:07 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2004-11-12 11:42:49 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Bastien Nocera 2004-10-15 05:51:27 EDT
Description of problem:
Remote Denial Of Service, and remote crash by sending malformed packets.

Version-Release number of selected component (if applicable):
All version of Freeradius prior to version 1.0.1 (to check)

From the freeradius ChangeLog:
FreeRADIUS 1.0.1 ; $Date: 2004/09/02 10:52:03 $, urgency=high
	Denial-of-Service Security Fix
	* Fix two remote crashes and a memory leak in RADIUS packet
	  decoding.

No CAN numbers have been associated with this issue:
http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=freeradius
Comment 1 Mark J. Cox (Product Security) 2004-10-15 06:00:12 EDT
http://www.kb.cert.org/vuls/id/541574
http://secunia.com/advisories/12570/

Removing security-sensitive tag as this issue is public.
Comment 2 Mark J. Cox (Product Security) 2004-10-18 11:10:19 EDT
RHSA-2004:609 in progress which will update FreeRADIUS to version
1.0.1 and also fix:

127168 - rebuilding freeradius picks up system libeap rather than
package libeap
127162 - zlib-devel is missing from BuildRequires in spec file
130606 - Missing buildrequires in freediag
130613 - radiusd.conf specifies other pam-auth than file installed in
/etc/pam.d
Comment 3 Mark J. Cox (Product Security) 2004-10-19 03:51:39 EDT
CAN-2004-0938, CAN-2004-0960, CAN-2004-0961 were assigned to these issues
Comment 4 Josh Bressers 2004-11-12 11:42:49 EST
An errata has been issued which should help the problem 
described in this bug report. This report is therefore being 
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files, 
please follow the link below. You may reopen this bug report 
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2004-609.html

Note You need to log in before you can comment on or make changes to this bug.