MDKSA-2007:092

Package name
freeradius
Date
2007-04-23
Advisory ID
MDKSA-2007:092
Affected versions
CS4.0 x86_64 , CS4.0 i586

Problem description

Multiple buffer overflows were found in the FreeRADIUS package version
1.0.4 and prior that could allow a remote attacker to cause a crash
via the rlm_sqlcounter module (CVE-2005-4746).

As well, an SQL injection vulnerability was also found in the
rlm_sqlcounter that could allow a remote attacker to execute arbitrary
SQL commands via unknown attack vectors (CVE-2005-4745).

Updated packages have been patched to correct this issue.

Updated packages

CS4.0 x86_64

 435d07e3a5878cb0fd27e02fbee702df  corporate/4.0/x86_64/freeradius-1.0.4-2.4.20060mlcs4.x86_64.rpm
 f57c46977fbd86772852f21d138605de  corporate/4.0/x86_64/lib64freeradius1-1.0.4-2.4.20060mlcs4.x86_64.rpm
 bcc4dc4cac18ed3d034483de311fe240  corporate/4.0/x86_64/lib64freeradius1-devel-1.0.4-2.4.20060mlcs4.x86_64.rpm
 646309915542dad2b6e68ff130fead11  corporate/4.0/x86_64/lib64freeradius1-krb5-1.0.4-2.4.20060mlcs4.x86_64.rpm
 039290c0f429ff9f5ecf1ce13b17765f  corporate/4.0/x86_64/lib64freeradius1-ldap-1.0.4-2.4.20060mlcs4.x86_64.rpm
 0ca4c838dae5657c3f902ed2234a7286  corporate/4.0/x86_64/lib64freeradius1-mysql-1.0.4-2.4.20060mlcs4.x86_64.rpm
 a48ad352690163f2fd90f022007bcd7a  corporate/4.0/x86_64/lib64freeradius1-postgresql-1.0.4-2.4.20060mlcs4.x86_64.rpm
 e8aea2d0c9a45462ef30ab0113b62164  corporate/4.0/x86_64/lib64freeradius1-unixODBC-1.0.4-2.4.20060mlcs4.x86_64.rpm 
 0fb72186b61687df8dedff8d874fbb86  corporate/4.0/SRPMS/freeradius-1.0.4-2.4.20060mlcs4.src.rpm

CS4.0 i586

 523055be4399355565d6175d7df13ca7  corporate/4.0/i586/freeradius-1.0.4-2.4.20060mlcs4.i586.rpm
 4e000a3cb2c8cb2f3359a961878a310a  corporate/4.0/i586/libfreeradius1-1.0.4-2.4.20060mlcs4.i586.rpm
 3e9f17beada7d6d10235c6db8156a77a  corporate/4.0/i586/libfreeradius1-devel-1.0.4-2.4.20060mlcs4.i586.rpm
 0429cf3dda93772e358fc34a1d5cb1f8  corporate/4.0/i586/libfreeradius1-krb5-1.0.4-2.4.20060mlcs4.i586.rpm
 216c28ffac0b1d03a493d5548556be2d  corporate/4.0/i586/libfreeradius1-ldap-1.0.4-2.4.20060mlcs4.i586.rpm
 07ebd1dbb7d4f1a71253ebab163f1dd8  corporate/4.0/i586/libfreeradius1-mysql-1.0.4-2.4.20060mlcs4.i586.rpm
 9b3586d1c94b6cf650723a095db846d7  corporate/4.0/i586/libfreeradius1-postgresql-1.0.4-2.4.20060mlcs4.i586.rpm
 10b8fb70adfc1a641b2f63c041db1069  corporate/4.0/i586/libfreeradius1-unixODBC-1.0.4-2.4.20060mlcs4.i586.rpm 
 0fb72186b61687df8dedff8d874fbb86  corporate/4.0/SRPMS/freeradius-1.0.4-2.4.20060mlcs4.src.rpm

References