Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 547
Alerts This Week
Warning Icon 1 547

Red Hat Enterprise Linux 5 RHSA-2009:1451 Moderate FreeRADIUS Issue

red hat
Calendar Grey September 17, 2009
Dist Redhat Esm H88
New FreeRADIUS updates have been released for Red Hat Enterprise Linux to address a moderate security vulnerability impacting network connectivity.
Updated freeradius packages that fix a security issue are now available for Red Hat Enterprise Linux 5

Solution

Before applying this update, make sure that all previously-released errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at

Summary

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.
An input validation flaw was discovered in the way FreeRADIUS decoded specific RADIUS attributes from RADIUS packets. A remote attacker could use this flaw to crash the RADIUS daemon (radiusd) via a specially-crafted RADIUS packet. (CVE-2009-3111)
Users of FreeRADIUS are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, radiusd will be restarted automatically.

Topics%20covered

Topics Covered

security advisory Red Hat Enterprise Linux freeradius network authentication moderate security RADIUS update

References

https://www.cve.org/CVERecord?id=CVE-2009-3111 https://access.redhat.com/security/updates/classification#moderate

Package List

RHEL Desktop Workstation (v. 5 client):
Source:
i386: freeradius-1.1.3-1.5.el5_4.i386.rpm freeradius-debuginfo-1.1.3-1.5.el5_4.i386.rpm freeradius-mysql-1.1.3-1.5.el5_4.i386.rpm freeradius-postgresql-1.1.3-1.5.el5_4.i386.rpm freeradius-unixODBC-1.1.3-1.5.el5_4.i386.rpm
x86_64: freeradius-1.1.3-1.5.el5_4.x86_64.rpm freeradius-debuginfo-1.1.3-1.5.el5_4.x86_64.rpm freeradius-mysql-1.1.3-1.5.el5_4.x86_64.rpm freeradius-postgresql-1.1.3-1.5.el5_4.x86_64.rpm freeradius-unixODBC-1.1.3-1.5.el5_4.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
Source:
i386: freeradius-1.1.3-1.5.el5_4.i386.rpm freeradius-debuginfo-1.1.3-1.5.el5_4.i386.rpm freeradius-mysql-1.1.3-1.5.el5_4.i386.rpm freeradius-postgresql-1.1.3-1.5.el5_4.i386.rpm freeradius-unixODBC-1.1.3-1.5.el5_4.i386.rpm
ia64: freeradius-1.1.3-1.5.el5_4.ia64.rpm freeradius-debuginfo-1.1.3-1.5.el5_4.ia64.rpm freeradius-mysql-1.1.3-1.5.el5_4.ia64.rpm freeradius-postgresql-1.1.3-1.5.el5_4.ia64.rpm freeradius-unixODBC-1.1.3-1.5.el5_4.ia64.rpm
ppc: freeradius-1.1.3-1.5.el5_4.ppc.rpm freeradius-debuginfo-1.1.3-1.5.el5_4.ppc.rpm freeradius-mysql-1.1.3-1.5.el5_4.ppc.rpm freeradius-postgresql-1.1.3-1.5.el5_4.ppc.rpm freeradius-unixODBC-1.1.3-1.5.el5_4.ppc.rpm
s390x: freeradius-1.1.3-1.5.el5_4.s390x.rpm

Read the Full Advisory


Advisory ID: RHSA-2009:1451-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2009:1451.html
Issue date: 2009-09-17

Topic

Updated freeradius packages that fix a security issue are now available forRed Hat Enterprise Linux 5.This update has been rated as having moderate security impact by the RedHat Security Response Team.

Topics%20covered

Topics Covered

security advisory Red Hat Enterprise Linux freeradius network authentication moderate security RADIUS update

Relevant Releases Architectures

RHEL Desktop Workstation (v. 5 client) - i386, x86_64

Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

Bugs Fixed

521912 - CVE-2009-3111 FreeRADIUS: Missing check for Tunnel-Password attributes with zero length (DoS) -- re-appearance of CVE-2003-0967

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.