pilla Bodhisattva
Joined: 07 Aug 2002 Posts: 7729 Location: Underworld
|
Posted: Fri Jul 11, 2003 5:55 pm Post subject: [gentoo-security] GLSA: cistonradius (200307-03) |
|
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - - ---------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200307-03
- - - ---------------------------------------------------------------------
PACKAGE : cistonradius
SUMMARY : buffer overflow
DATE : 2003-07-11 13:57 UTC
EXPLOIT : remote
VERSIONS AFFECTED : <cistronradius-1.6.6-r1
FIXED VERSION : >=cistronradius-1.6.6-r1
CVE : CAN-2003-0450
- - - ---------------------------------------------------------------------
quote from CVE:
"Cistron RADIUS daemon (radiusd-cistron) 1.6.6 and earlier allows remote
attackers to cause a denial of service and possibly execute arbitrary
code via a large value in an NAS-Port attribute, which is interpreted
as a negative number and causes a buffer overflow."
SOLUTION
It is recommended that all Gentoo Linux users who are running
net-dialup/cistronradius upgrade to cistronradius-1.6.6-r1 as follows
emerge sync
emerge cistronradius
emerge clean
- - - ---------------------------------------------------------------------
aliz@gentoo.org - GnuPG key is available at http://dev.gentoo.org/~aliz
- - - ---------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
iD8DBQE/DsJGfT7nyhUpoZMRAtywAKCGIJog6cuws22Hik1a3i6/gxz7ogCdEjFJ
8EALai5C7bskp5qhwxbPj3k=
=POu6
-----END PGP SIGNATURE----- _________________ "I'm just very selective about the reality I choose to accept." -- Calvin |
|