-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT
- --------------------------------------------------------------------------

PACKAGE : radiusd-cistron
SUMMARY : Buffer overflow vulnerability
DATE : 2003-06-27 12:07:00
ID : CLA-2003:664
RELEVANT
RELEASES : 7.0, 8, 9

- -------------------------------------------------------------------------

DESCRIPTION
Cistron RADIUS is an authentication and accounting system for
terminal servers that speak the RADIUS (Remote Authentication Dial In
User Service) protocol.

David Luyer reported[1] a buffer overflow vulnerability in
radiusd-cistron versions <= 1.6.6 that could allow remote attackers
to cause a denial of service (DoS) and possibly execute arbitrary
code in the server context. The vulnerability resides in the handling
of the NAS-Port attribute, which can be interpreted as a negative
number, causing a buffer overflow.

The Common Vulnerabilities and Exposures (CVE) project has assigned
the name CAN-2003-0450 to this issue[2].

This update fixes the problem using a patched version of
radiusd-cistron 1.6.6.


SOLUTION
All radius-cistron users should upgrade. This update will
automatically restart the service if it is already running.


REFERENCES:
1.http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=196063
2.http://cve.mitre.org/cgi-bin/cvename...=CAN-2003-0450
3.http://distro2.conectiva.com.br/bugz...ug.cgi?id=8690


UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/...0_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/...70_2cl.src.rpm
ftp://atualizacoes.conectiva.com.br/...0_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/...80_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/...0_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/...90_1cl.src.rpm


ADDITIONAL INSTRUCTIONS
The apt tool can be used to perform RPM packages upgrades:

- run: apt-get update
- after that, execute: apt-get upgrade

Detailed instructions reagarding the use of apt and upgrade examples
can be found at http://distro.conectiva.com.br/atual...#apt?idioma=en

- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at
http://distro.conectiva.com.br/segur...ave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/segur...ica/?idioma=en

- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en

- -------------------------------------------------------------------------
Copyright (c) 2003 Conectiva Inc.
http://www.conectiva.com

- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papale...nectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE+/F+U42jd0JmAcZARAlFOAKCNzmMAbFhslc6gMnlvB9s005oTxQC eMYGA
uM/HQtms2TwWXp2kLE+ItqA=
=zydz
-----END PGP SIGNATURE-----