-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDKSA-2007:092 http://www.mandriva.com/security/ _______________________________________________________________________ Package : freeradius Date : April 23, 2007 Affected: Corporate 4.0 _______________________________________________________________________ Problem Description: Multiple buffer overflows were found in the FreeRADIUS package version 1.0.4 and prior that could allow a remote attacker to cause a crash via the rlm_sqlcounter module (CVE-2005-4746). As well, an SQL injection vulnerability was also found in the rlm_sqlcounter that could allow a remote attacker to execute arbitrary SQL commands via unknown attack vectors (CVE-2005-4745). Updated packages have been patched to correct this issue. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4745 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4746 _______________________________________________________________________ Updated Packages: Corporate 4.0: 523055be4399355565d6175d7df13ca7 corporate/4.0/i586/freeradius-1.0.4-2.4.20060mlcs4.i586.rpm 4e000a3cb2c8cb2f3359a961878a310a corporate/4.0/i586/libfreeradius1-1.0.4-2.4.20060mlcs4.i586.rpm 3e9f17beada7d6d10235c6db8156a77a corporate/4.0/i586/libfreeradius1-devel-1.0.4-2.4.20060mlcs4.i586.rpm 0429cf3dda93772e358fc34a1d5cb1f8 corporate/4.0/i586/libfreeradius1-krb5-1.0.4-2.4.20060mlcs4.i586.rpm 216c28ffac0b1d03a493d5548556be2d corporate/4.0/i586/libfreeradius1-ldap-1.0.4-2.4.20060mlcs4.i586.rpm 07ebd1dbb7d4f1a71253ebab163f1dd8 corporate/4.0/i586/libfreeradius1-mysql-1.0.4-2.4.20060mlcs4.i586.rpm 9b3586d1c94b6cf650723a095db846d7 corporate/4.0/i586/libfreeradius1-postgresql-1.0.4-2.4.20060mlcs4.i586.rpm 10b8fb70adfc1a641b2f63c041db1069 corporate/4.0/i586/libfreeradius1-unixODBC-1.0.4-2.4.20060mlcs4.i586.rpm 0fb72186b61687df8dedff8d874fbb86 corporate/4.0/SRPMS/freeradius-1.0.4-2.4.20060mlcs4.src.rpm Corporate 4.0/X86_64: 435d07e3a5878cb0fd27e02fbee702df corporate/4.0/x86_64/freeradius-1.0.4-2.4.20060mlcs4.x86_64.rpm f57c46977fbd86772852f21d138605de corporate/4.0/x86_64/lib64freeradius1-1.0.4-2.4.20060mlcs4.x86_64.rpm bcc4dc4cac18ed3d034483de311fe240 corporate/4.0/x86_64/lib64freeradius1-devel-1.0.4-2.4.20060mlcs4.x86_64.rpm 646309915542dad2b6e68ff130fead11 corporate/4.0/x86_64/lib64freeradius1-krb5-1.0.4-2.4.20060mlcs4.x86_64.rpm 039290c0f429ff9f5ecf1ce13b17765f corporate/4.0/x86_64/lib64freeradius1-ldap-1.0.4-2.4.20060mlcs4.x86_64.rpm 0ca4c838dae5657c3f902ed2234a7286 corporate/4.0/x86_64/lib64freeradius1-mysql-1.0.4-2.4.20060mlcs4.x86_64.rpm a48ad352690163f2fd90f022007bcd7a corporate/4.0/x86_64/lib64freeradius1-postgresql-1.0.4-2.4.20060mlcs4.x86_64.rpm e8aea2d0c9a45462ef30ab0113b62164 corporate/4.0/x86_64/lib64freeradius1-unixODBC-1.0.4-2.4.20060mlcs4.x86_64.rpm 0fb72186b61687df8dedff8d874fbb86 corporate/4.0/SRPMS/freeradius-1.0.4-2.4.20060mlcs4.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) iD8DBQFGLO1nmqjQ0CJFipgRAsFaAJ9co3OlDWZ/TbgBhXObcQQisfeV7wCglV83 4mS7Fi8Nr26rU13+J4dlRxM= =UflY -----END PGP SIGNATURE-----