Alerts This Week
Warning Icon 1 1,154
Alerts This Week
Warning Icon 1 1,154

Red Hat Enterprise Linux 5: RHSA-2009:1451-01 Moderate: freeradius DoS

red hat
Calendar Grey September 17, 2009
Dist Redhat Esm H88
A vital patch for FreeRADIUS on Red Hat addresses key issues related to moderate security vulnerabilities that affect the server.
Updated freeradius packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Ha...

Solution

Before applying this update, make sure that all previously-released errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at

Summary

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.
An input validation flaw was discovered in the way FreeRADIUS decoded specific RADIUS attributes from RADIUS packets. A remote attacker could use this flaw to crash the RADIUS daemon (radiusd) via a specially-crafted RADIUS packet. (CVE-2009-3111)
Users of FreeRADIUS are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, radiusd will be restarted automatically.

Topics%20covered

Topics Covered

security advisory DoS Red Hat Enterprise Linux moderate severity freeradius

References

https://www.cve.org/CVERecord?id=CVE-2009-3111 https://access.redhat.com/security/updates/classification#moderate

Package List

RHEL Desktop Workstation (v. 5 client):
Source:
i386: freeradius-1.1.3-1.5.el5_4.i386.rpm freeradius-debuginfo-1.1.3-1.5.el5_4.i386.rpm freeradius-mysql-1.1.3-1.5.el5_4.i386.rpm freeradius-postgresql-1.1.3-1.5.el5_4.i386.rpm freeradius-unixODBC-1.1.3-1.5.el5_4.i386.rpm
x86_64: freeradius-1.1.3-1.5.el5_4.x86_64.rpm freeradius-debuginfo-1.1.3-1.5.el5_4.x86_64.rpm freeradius-mysql-1.1.3-1.5.el5_4.x86_64.rpm freeradius-postgresql-1.1.3-1.5.el5_4.x86_64.rpm freeradius-unixODBC-1.1.3-1.5.el5_4.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
Source:
i386: freeradius-1.1.3-1.5.el5_4.i386.rpm freeradius-debuginfo-1.1.3-1.5.el5_4.i386.rpm freeradius-mysql-1.1.3-1.5.el5_4.i386.rpm freeradius-postgresql-1.1.3-1.5.el5_4.i386.rpm freeradius-unixODBC-1.1.3-1.5.el5_4.i386.rpm
ia64: freeradius-1.1.3-1.5.el5_4.ia64.rpm freeradius-debuginfo-1.1.3-1.5.el5_4.ia64.rpm freeradius-mysql-1.1.3-1.5.el5_4.ia64.rpm freeradius-postgresql-1.1.3-1.5.el5_4.ia64.rpm freeradius-unixODBC-1.1.3-1.5.el5_4.ia64.rpm
ppc: freeradius-1.1.3-1.5.el5_4.ppc.rpm freeradius-debuginfo-1.1.3-1.5.el5_4.ppc.rpm freeradius-mysql-1.1.3-1.5.el5_4.ppc.rpm freeradius-postgresql-1.1.3-1.5.el5_4.ppc.rpm freeradius-unixODBC-1.1.3-1.5.el5_4.ppc.rpm
s390x: freeradius-1.1.3-1.5.el5_4.s390x.rpm

Read the Full Advisory


Advisory ID: RHSA-2009:1451-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2009:1451.html
Issue date: 2009-09-17

Topic

Updated freeradius packages that fix a security issue are now available forRed Hat Enterprise Linux 5.This update has been rated as having moderate security impact by the RedHat Security Response Team.

Topics%20covered

Topics Covered

security advisory DoS Red Hat Enterprise Linux moderate severity freeradius

Relevant Releases Architectures

RHEL Desktop Workstation (v. 5 client) - i386, x86_64

Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

Bugs Fixed

521912 - CVE-2009-3111 FreeRADIUS: Missing check for Tunnel-Password attributes with zero length (DoS) -- re-appearance of CVE-2003-0967

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here