Stay Secure with the Latest Linux Advisories

security advisorygentoobuffer overflow

Gentoo: 200307-03 Critical: Cistron Radius Buffer Overflow Remote Attack

Cistron RADIUS daemon (radiusd-cistron) 1.6.6 and earlier allows remoteattackers to cause a denial of service and possibly execute arbitrarycode via a large value in an NAS-Port attribute, which is interpretedas a negative number and causes a buffer overflow.. - - --------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200307-03 - - --------------------------------------------------------------------- PACKAGE : cistonradius SUMMARY : buffer overflow DATE : 2003-07-11 13:57 UTC EXPLOIT : remote VERSIONS AFFECTED : =cistronradius-1.6.6-r1 CVE : CAN-2003-0450 - - --------------------------------------------------------------------- quote from CVE: "Cistron RADIUS daemon (radiusd-cistron) 1.6.6 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large value in an NAS-Port attribute, which is interpreted as a negative number and causes a buffer overflow." SOLUTION It is recommended that all Gentoo Linux users who are running net-dialup/cistronradius upgrade to cistronradius-1.6.6-r1 as follows emerge sync emerge cistronradius emerge clean - - --------------------------------------------------------------------- This email address is being protected from spambots. You need JavaScript enabled to view it. - GnuPG key is available at - - --------------------------------------------------------------------- . Gentoo's critical Cistron Radius advisory details a buffer overflow risk leading to remote attacks.. cistron radius, buffer overflow, remote exploit. . Severity: Critical. LinuxSecurity.com Team

Jul 11, 2003 •Critical Gentoo