Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2014.0351 Updated freeradius package fixes security vulnerability 17 March 2014 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: freeradius Publisher: Mandriva Operating System: UNIX variants (UNIX, Linux, OSX) Mandriva Linux Impact/Access: Execute Arbitrary Code/Commands -- Existing Account Denial of Service -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2014-2015 Original Bulletin: http://advisories.mageia.org/MGASA-2014-0088.html Comment: This advisory references vulnerabilities in products which run on platforms other than Mandriva. It is recommended that administrators running freeradius check for an updated version of the software for their operating system. - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2014:058 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : freeradius Date : March 13, 2014 Affected: Business Server 1.0, Enterprise Server 5.0 _______________________________________________________________________ Problem Description: Updated freeradius package fixes security vulnerability: SSHA processing in freeradius before 2.2.3 runs into a stack-based buffer overflow in the freeradius rlm_pap module if the password source uses an unusually long hashed password (CVE-2014-2015). _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2015 http://advisories.mageia.org/MGASA-2014-0088.html _______________________________________________________________________ Updated Packages: Mandriva Enterprise Server 5: ad944c9074b82a96e5bca829cb9e53a6 mes5/i586/freeradius-2.1.0-3.2mdvmes5.2.i586.rpm a99e3e6e10a0856e4d755d17653865a0 mes5/i586/freeradius-krb5-2.1.0-3.2mdvmes5.2.i586.rpm 322a9c4b628cf1e94263c060b6978fde mes5/i586/freeradius-ldap-2.1.0-3.2mdvmes5.2.i586.rpm e554bcf6daa40436f85ad06b4bc4a81a mes5/i586/freeradius-mysql-2.1.0-3.2mdvmes5.2.i586.rpm 95588e3bdf6cf1f1711416c1966a5683 mes5/i586/freeradius-postgresql-2.1.0-3.2mdvmes5.2.i586.rpm e998de66a546e5f1c325a1aae720ce8d mes5/i586/freeradius-unixODBC-2.1.0-3.2mdvmes5.2.i586.rpm 92cc08607f5a1db4b8181f3fa1f882ac mes5/i586/freeradius-web-2.1.0-3.2mdvmes5.2.i586.rpm 59efbacd16cd43b769194eebd86b9aa8 mes5/i586/libfreeradius1-2.1.0-3.2mdvmes5.2.i586.rpm c22ae710c958e08cd230f90b4a8dd02d mes5/i586/libfreeradius-devel-2.1.0-3.2mdvmes5.2.i586.rpm cc1524d78d985dcfe1cc52e0c4167c53 mes5/SRPMS/freeradius-2.1.0-3.2mdvmes5.2.src.rpm Mandriva Enterprise Server 5/X86_64: 56840a173c160cba06a7fb7c80ddb64f mes5/x86_64/freeradius-2.1.0-3.2mdvmes5.2.x86_64.rpm 0941ddc851295f4925de5f583da68475 mes5/x86_64/freeradius-krb5-2.1.0-3.2mdvmes5.2.x86_64.rpm e4af5670c6cab9b67add4e70aed3b684 mes5/x86_64/freeradius-ldap-2.1.0-3.2mdvmes5.2.x86_64.rpm 25df0aba6eee4288d21ecda61c30b778 mes5/x86_64/freeradius-mysql-2.1.0-3.2mdvmes5.2.x86_64.rpm b9ccf0bc86cdc0b3cd05bfa4fabacf2a mes5/x86_64/freeradius-postgresql-2.1.0-3.2mdvmes5.2.x86_64.rpm 7826a0387961c9d212be1532f2455664 mes5/x86_64/freeradius-unixODBC-2.1.0-3.2mdvmes5.2.x86_64.rpm d20ac56207ef50426beaea46e1196c63 mes5/x86_64/freeradius-web-2.1.0-3.2mdvmes5.2.x86_64.rpm 1dad7dd1a4b40a99c21edc8598b7aeea mes5/x86_64/lib64freeradius1-2.1.0-3.2mdvmes5.2.x86_64.rpm 047d0222be6c58c6757fb63c4489e91e mes5/x86_64/lib64freeradius-devel-2.1.0-3.2mdvmes5.2.x86_64.rpm cc1524d78d985dcfe1cc52e0c4167c53 mes5/SRPMS/freeradius-2.1.0-3.2mdvmes5.2.src.rpm Mandriva Business Server 1/X86_64: 0057f36548b76ab4309513af32189a7a mbs1/x86_64/freeradius-2.1.12-9.2.mbs1.x86_64.rpm bf926a73a78b4d71ed289882174faff0 mbs1/x86_64/freeradius-krb5-2.1.12-9.2.mbs1.x86_64.rpm 2a4d779f740e148179a2fa47f6b5d11a mbs1/x86_64/freeradius-ldap-2.1.12-9.2.mbs1.x86_64.rpm 6194d14adfb3a1be7098d6a80c68666c mbs1/x86_64/freeradius-mysql-2.1.12-9.2.mbs1.x86_64.rpm aa9d2789f6ba9ef13ddcbd8f1401053b mbs1/x86_64/freeradius-postgresql-2.1.12-9.2.mbs1.x86_64.rpm dced45a8d3116fda640cbf87a92045d9 mbs1/x86_64/freeradius-sqlite-2.1.12-9.2.mbs1.x86_64.rpm 6334b8e46550b4386845e965de3ddd6e mbs1/x86_64/freeradius-unixODBC-2.1.12-9.2.mbs1.x86_64.rpm 7c50512bed1debd14c01ac39a23664a0 mbs1/x86_64/freeradius-web-2.1.12-9.2.mbs1.x86_64.rpm 180924551409613494f9d37e171981bd mbs1/x86_64/lib64freeradius1-2.1.12-9.2.mbs1.x86_64.rpm aa658a202d8dfa5d34126b548206afb9 mbs1/x86_64/lib64freeradius-devel-2.1.12-9.2.mbs1.x86_64.rpm d71925925b1416ea729b8b85c7f0919c mbs1/SRPMS/freeradius-2.1.12-9.2.mbs1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFTIaX3mqjQ0CJFipgRAmfrAJ4+2PFcRArhKtgBxVFMRghXs3mB+QCfQNcE KMIx0VlhDi+BX+cm21ZnGgQ= =MBcL - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBUyZpohLndAQH1ShLAQKIHhAAvk0BjYx5Uu2plzqZaesm3y3TPeGnQwSi pIn6awQ32lTmfPuELWEAegiRvBXqaTToOu/N+VTmgKnHSXp4Gkn9zEkDgaKsxwXk u0ScFOzIylQ/RuRqzNL7S6VplfjqYB1FuK7mjIpqMKv6M6FtfbqSpldZEXsCs+4E acm89aqpDCWIh9C5Us2VEzn9JLd4FGHj4ttWzQDelci4NmSsIXADEDs+eNfoNHQg M+xymTYIS3u6HlPldbbubDlU8r16CjalUB5abmyv0AfPxLSvJLmiRemUPLSTdl/h gLUJMp+hBvD3NBC0EqIybClss/Zq1W8Hw6zbkWotFhddsGRgpaysQA5lXp+qCOqy PJq0oVe1Ja9LLcTjh64oSTWEHCoCDtHaGLW5kNWFxkiSq6Vzh8vXAlcEtJfpMLgA nuYDzZz3Z03+Y8652gk3jRcvp+4LzFBrzJ6D1yn9hhKQR7AC+HspZ4KDO56no+Ol KWojHjZ+wX5dGpBKxOV+Dqwe54uBRH0oo8RYKVP6HNCHCCwajqMh5LKgklAoGXTZ Z4pxnmoUHXmOc95OqSx3vnFeyyWqzp2v4lHQQVCddomNnwxaFfrsnQeQILhwBav1 Fu3Dvf/gmYuLYhZhRcKlWZF3bRd7FFiRWqLlIEBgSEwb3uORA3ESW2EOl2CzcxCM mZdS+lZVwH8= =a8Sx -----END PGP SIGNATURE-----