- - ---------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200307-03
- - ---------------------------------------------------------------------

          PACKAGE : cistonradius
          SUMMARY : buffer overflow
             DATE : 2003-07-11 13:57 UTC
          EXPLOIT : remote
VERSIONS AFFECTED : =cistronradius-1.6.6-r1
              CVE : CAN-2003-0450

- - ---------------------------------------------------------------------

quote from CVE:
"Cistron RADIUS daemon (radiusd-cistron) 1.6.6 and earlier allows remote
attackers to cause a denial of service and possibly execute arbitrary
code via a large value in an NAS-Port attribute, which is interpreted
as a negative number and causes a buffer overflow."

SOLUTION

It is recommended that all Gentoo Linux users who are running
net-dialup/cistronradius upgrade to cistronradius-1.6.6-r1 as follows

emerge sync
emerge cistronradius
emerge clean

- - ---------------------------------------------------------------------
aliz@gentoo.org - GnuPG key is available at   
- - ---------------------------------------------------------------------