Conectiva Linux Security Announcement: radiusd-cistron

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT 
- --------------------------------------------------------------------------

PACKAGE   : radiusd-cistron
SUMMARY   : Multiple vulnerabilities
DATE      : 2002-03-06 16:43:00
ID        : CLA-2002:466
RELEVANT
RELEASES  : 5.0, prg graficos, ecommerce, 5.1, 6.0, 7.0

- -------------------------------------------------------------------------

DESCRIPTION
 Cistron RADIUS is an authentication and accounting server for
 terminal servers that speak the RADIUS (Remote Authentication Dial In
 User Service) protocol.
 
 Alan DeKok reported[1] some vulnerabilities in multiple RADIUS server
 implementations (including radius-cistron).
 
 radius-cistron prior to 1.6.6 was vulnerable to:
 
 - A buffer overflow in a message digest calculation[2] that could let
 an attacker to sucessfully run a Deny of Service (DoS) attack againt
 the server. If the attacker also knows the shared secret (discovering
 it is not a trivial task), there's a possibility to exploit this
 vulnerability to execute arbitrary code in the remote machine (with
 root privileges).
 
 - A failure to check the vendor-length of vendor-specific attributes,
 also possibiliting a Denial of Service attack against RADIUS
 servers.
 
 There's a complete advisory[3] with more information available from
 CERT® addressing these vulnerabilities.


SOLUTION
 All radius-cistron users should upgrade. This update will
 automatically restart the service if it's running.
 
 
 REFERENCES:
 1.http://online.securityfocus.com/archive/1/239943
 2.http://online.securityfocus.com/bid/3530
 3.http://www.cert.org/advisories/CA-2002-06.html


DIRECT DOWNLOAD LINKS TO THE UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/5.0/5.0/SRPMS/radiusd-cistron-1.6.6-1U50_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/5.0/5.0/i386/radiusd-cistron-1.6.6-1U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/5.1/SRPMS/radiusd-cistron-1.6.6-1U51_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/5.1/5.1/i386/radiusd-cistron-1.6.6-1U51_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/6.0/SRPMS/radiusd-cistron-1.6.6-1U60_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/6.0/6.0/RPMS/radiusd-cistron-1.6.6-1U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/7.0/SRPMS/radiusd-cistron-1.6.6-1U70_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/7.0/RPMS/radiusd-cistron-1.6.6-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/5.0/SRPMS/radiusd-cistron-1.6.6-1U50_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/5.0/i386/radiusd-cistron-1.6.6-1U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/5.0/SRPMS/radiusd-cistron-1.6.6-1U50_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/5.0/i386/radiusd-cistron-1.6.6-1U50_1cl.i386.rpm


ADDITIONAL INSTRUCTIONS
 Users of Conectiva Linux version 6.0 or higher may use apt to perform 
 upgrades of RPM packages:
 - add the following line to /etc/apt/sources.list if it is not there yet
   (you may also use linuxconf to do this):

 rpm [cncbr] ftp://atualizacoes.conectiva.com.br 6.0/conectiva updates

(replace 6.0 with the correct version number if you are not running CL6.0)

 - run:                 apt-get update
 - after that, execute: apt-get upgrade

 Detailed instructions reagarding the use of apt and upgrade examples 
 can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en


- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at 
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en