| Summary: | freeradius new security issue CVE-2014-2015 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | major | ||
| Priority: | Normal | CC: | fundawang, oe, rverschelde, sysadmin-bugs, tmb, wilcal.int |
| Version: | 4 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/588047/ | ||
| Whiteboard: | MGA3TOO has_procedure MGA3-32-OK MGA3-64-OK MGA4-32-OK MGA4-64-OK advisory | ||
| Source RPM: | freeradius-2.2.0-4.mga3.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2014-02-18 16:32:08 CET
David Walser
2014-02-18 16:32:25 CET
CC:
(none) =>
fundawang Thanks Oden. Patched packages uploaded for Mageia 3 and Mageia 4. Advisory: ======================== Updated freeradius packages fix security vulnerability: SSHA processing in freeradius before 2.2.3 runs into a stack-based buffer overflow in the freeradius rlm_pap module if the password source uses an unusually long hashed password (CVE-2014-2015). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2015 http://lists.freebsd.org/pipermail/freebsd-bugbusters/2014-February/000610.html http://openwall.com/lists/oss-security/2014/02/18/3 https://bugzilla.redhat.com/show_bug.cgi?id=1066761 ======================== Updated packages in core/updates_testing: ======================== freeradius-2.2.0-4.1.mga3 freeradius-krb5-2.2.0-4.1.mga3 freeradius-ldap-2.2.0-4.1.mga3 freeradius-postgresql-2.2.0-4.1.mga3 freeradius-mysql-2.2.0-4.1.mga3 freeradius-unixODBC-2.2.0-4.1.mga3 freeradius-sqlite-2.2.0-4.1.mga3 freeradius-yubikey-2.2.0-4.1.mga3 libfreeradius1-2.2.0-4.1.mga3 libfreeradius-devel-2.2.0-4.1.mga3 freeradius-web-2.2.0-4.1.mga3 freeradius-2.2.0-5.1.mga4 freeradius-krb5-2.2.0-5.1.mga4 freeradius-ldap-2.2.0-5.1.mga4 freeradius-postgresql-2.2.0-5.1.mga4 freeradius-mysql-2.2.0-5.1.mga4 freeradius-unixODBC-2.2.0-5.1.mga4 freeradius-sqlite-2.2.0-5.1.mga4 freeradius-yubikey-2.2.0-5.1.mga4 libfreeradius1-2.2.0-5.1.mga4 libfreeradius-devel-2.2.0-5.1.mga4 freeradius-web-2.2.0-5.1.mga4 from SRPMS: freeradius-2.2.0-4.1.mga3.src.rpm freeradius-2.2.0-5.1.mga4.src.rpm Assignee:
bugsquad =>
qa-bugs In VirtualBox, M3, KDE, 32-bit Package(s) under test: freeradius default updated install of freeradius [root@localhost wilcal]# urpmi freeradius Package freeradius-2.2.0-4.mga3.i586 is already installed ran simple tests as described in: http://freeradius.org/doc/ [root@localhost wilcal]# radiusd -X freeradius seems to be responding. Added testing Cleartext-Password := "password" to /etc/raddb/users [root@localhost wilcal]# radtest testing password 127.0.0.1 0 testing123 freeradius seems to be responding. install freeradius from updates_testing [root@localhost wilcal]# urpmi freeradius Package freeradius-2.2.0-4.1.mga3.i586 is already installed ran simple tests as described in: http://freeradius.org/doc/ [root@localhost wilcal]# radiusd -X freeradius seems to be responding. Added testing Cleartext-Password := "password" to /etc/raddb/users [root@localhost wilcal]# radtest testing password 127.0.0.1 0 testing123 freeradius seems to be responding. Test platform: Intel Core i7-2600K Sandy Bridge 3.4GHz GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB RTL8111/8168B PCI Express 1Gbit Ethernet DRAM 16GB (4 x 4GB) Mageia 4 64-bit, Nvidia driver VirtualBox 4.3.6-1.mga4.x86_64.rpm CC:
(none) =>
wilcal.int In VirtualBox, M3, KDE, 64-bit Package(s) under test: freeradius default updated install of freeradius [root@localhost wilcal]# urpmi freeradius Package freeradius-2.2.0-4.mga3.x86_64 is already installed ran simple tests as described in: http://freeradius.org/doc/ [root@localhost wilcal]# radiusd -X freeradius seems to be responding. Added to /etc/raddb/users [root@localhost wilcal]# radtest testing password 127.0.0.1 0 testing123 freeradius seems to be responding. install freeradius from updates_testing [root@localhost wilcal]# urpmi freeradius Package freeradius-2.2.0-4.1.mga3.x86_64 is already installed ran simple tests as described in: http://freeradius.org/doc/ [root@localhost wilcal]# radiusd -X freeradius seems to be responding. Added testing Cleartext-Password := "password" to /etc/raddb/users [root@localhost wilcal]# radtest testing password 127.0.0.1 0 testing123 freeradius seems to be responding. Test platform: Intel Core i7-2600K Sandy Bridge 3.4GHz GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB RTL8111/8168B PCI Express 1Gbit Ethernet DRAM 16GB (4 x 4GB) Mageia 4 64-bit, Nvidia driver VirtualBox 4.3.6-1.mga4.x86_64.rpm Whiteboard:
MGA3TOO has_procedure MGA3-32-OK =>
MGA3TOO has_procedure MGA3-32-OK MGA3-64-OK In VirtualBox, M4, KDE, 32-bit Package(s) under test: freeradius default updated install of freeradius [root@localhost wilcal]# urpmi freeradius Package freeradius-2.2.0-5.mga4.i586 is already installed ran simple tests as described in: http://freeradius.org/doc/ [root@localhost wilcal]# radiusd -X freeradius seems to be responding. Added testing Cleartext-Password := "password" to /etc/raddb/users [root@localhost wilcal]# radtest testing password 127.0.0.1 0 testing123 freeradius seems to be responding. install freeradius from updates_testing [root@localhost wilcal]# urpmi freeradius Package freeradius-2.2.0-5.1.mga4.i586 is already installed ran simple tests as described in: http://freeradius.org/doc/ [root@localhost wilcal]# radiusd -X freeradius seems to be responding. Added testing Cleartext-Password := "password" to /etc/raddb/users [root@localhost wilcal]# radtest testing password 127.0.0.1 0 testing123 freeradius seems to be responding. Test platform: Intel Core i7-2600K Sandy Bridge 3.4GHz GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB RTL8111/8168B PCI Express 1Gbit Ethernet DRAM 16GB (4 x 4GB) Mageia 4 64-bit, Nvidia driver VirtualBox 4.3.6-1.mga4.x86_64.rpm Whiteboard:
MGA3TOO has_procedure MGA3-32-OK MGA3-64-OK =>
MGA3TOO has_procedure MGA3-32-OK MGA3-64-OK MGA4-32-OK In VirtualBox, M4, KDE, 64-bit Package(s) under test: freeradius default updated install of freeradius [root@localhost wilcal]# urpmi freeradius Package freeradius-2.2.0-5.mga4.x86_64 is already installed ran simple tests as described in: http://freeradius.org/doc/ [root@localhost wilcal]# radiusd -X freeradius seems to be responding. Added testing Cleartext-Password := "password" to /etc/raddb/users [root@localhost wilcal]# radtest testing password 127.0.0.1 0 testing123 freeradius seems to be responding. install freeradius from updates_testing [root@localhost wilcal]# urpmi freeradius Package freeradius-2.2.0-5.1.mga4.x86_64 is already installed ran simple tests as described in: http://freeradius.org/doc/ [root@localhost wilcal]# radiusd -X freeradius seems to be responding. Added testing Cleartext-Password := "password" to /etc/raddb/users [root@localhost wilcal]# radtest testing password 127.0.0.1 0 testing123 freeradius seems to be responding. Test platform: Intel Core i7-2600K Sandy Bridge 3.4GHz GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB RTL8111/8168B PCI Express 1Gbit Ethernet DRAM 16GB (4 x 4GB) Mageia 4 64-bit, Nvidia driver VirtualBox 4.3.6-1.mga4.x86_64.rpm Whiteboard:
MGA3TOO has_procedure MGA3-32-OK MGA3-64-OK MGA4-32-OK =>
MGA3TOO has_procedure MGA3-32-OK MGA3-64-OK MGA4-32-OK MGA4-64-OK For me this update works fine as best I can test it. I think someone can make a career out of understanding this Go ahead and push it. Validating update, advisory has been uploaded. Please push to 3 & 4 core/updates. Keywords:
(none) =>
validated_update Update pushed: http://advisories.mageia.org/MGASA-2014-0088.html Status:
NEW =>
RESOLVED
David Walser
2014-02-24 23:02:57 CET
URL:
(none) =>
http://lwn.net/Vulnerabilities/588047/ |