Gentoo alert 200307-03 (cistonradius) [LWN.net]


From:
    	       aliz@gentoo.org (Daniel Ahlberg)
To:
    	       gentoo-announce@gentoo.org
Subject:
    	       GLSA:  cistonradius (200307-03)
Date:
    	       Fri, 11 Jul 2003 15:57:26 +0200 (CEST)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - - ---------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200307-03
- - - ---------------------------------------------------------------------

          PACKAGE : cistonradius
          SUMMARY : buffer overflow
             DATE : 2003-07-11 13:57 UTC
          EXPLOIT : remote
VERSIONS AFFECTED : <cistronradius-1.6.6-r1
    FIXED VERSION : >=cistronradius-1.6.6-r1
              CVE : CAN-2003-0450

- - - ---------------------------------------------------------------------

quote from CVE:
"Cistron RADIUS daemon (radiusd-cistron) 1.6.6 and earlier allows remote 
attackers to cause a denial of service and possibly execute arbitrary 
code via a large value in an NAS-Port attribute, which is interpreted 
as a negative number and causes a buffer overflow."

SOLUTION

It is recommended that all Gentoo Linux users who are running
net-dialup/cistronradius upgrade to cistronradius-1.6.6-r1 as follows

emerge sync
emerge cistronradius
emerge clean

- - - ---------------------------------------------------------------------
aliz@gentoo.org - GnuPG key is available at http://dev.gentoo.org/~aliz
- - - ---------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQE/DsJGfT7nyhUpoZMRAtywAKCGIJog6cuws22Hik1a3i6/gxz7ogCdEjFJ
8EALai5C7bskp5qhwxbPj3k=
=POu6
-----END PGP SIGNATURE-----

From:		aliz@gentoo.org (Daniel Ahlberg)
To:		gentoo-announce@gentoo.org
Subject:		GLSA: cistonradius (200307-03)
Date:		Fri, 11 Jul 2003 15:57:26 +0200 (CEST)