A CVE has been assigned for a remote DoS issue in freeradius: http://openwall.com/lists/oss-security/2014/02/18/3 I'm guessing Oden fixed this with upgrading to 2.2.3 in Cauldron, but Mageia 3 and Mageia 4 may need a fix for this. Upstream patches are linked in the above URL. Reproducible: Steps to Reproduce:
CC: (none) => fundawangWhiteboard: (none) => MGA3TOO
https://bugzilla.redhat.com/show_bug.cgi?id=1066761
CC: (none) => oe
Thanks Oden. Patched packages uploaded for Mageia 3 and Mageia 4. Advisory: ======================== Updated freeradius packages fix security vulnerability: SSHA processing in freeradius before 2.2.3 runs into a stack-based buffer overflow in the freeradius rlm_pap module if the password source uses an unusually long hashed password (CVE-2014-2015). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2015 http://lists.freebsd.org/pipermail/freebsd-bugbusters/2014-February/000610.html http://openwall.com/lists/oss-security/2014/02/18/3 https://bugzilla.redhat.com/show_bug.cgi?id=1066761 ======================== Updated packages in core/updates_testing: ======================== freeradius-2.2.0-4.1.mga3 freeradius-krb5-2.2.0-4.1.mga3 freeradius-ldap-2.2.0-4.1.mga3 freeradius-postgresql-2.2.0-4.1.mga3 freeradius-mysql-2.2.0-4.1.mga3 freeradius-unixODBC-2.2.0-4.1.mga3 freeradius-sqlite-2.2.0-4.1.mga3 freeradius-yubikey-2.2.0-4.1.mga3 libfreeradius1-2.2.0-4.1.mga3 libfreeradius-devel-2.2.0-4.1.mga3 freeradius-web-2.2.0-4.1.mga3 freeradius-2.2.0-5.1.mga4 freeradius-krb5-2.2.0-5.1.mga4 freeradius-ldap-2.2.0-5.1.mga4 freeradius-postgresql-2.2.0-5.1.mga4 freeradius-mysql-2.2.0-5.1.mga4 freeradius-unixODBC-2.2.0-5.1.mga4 freeradius-sqlite-2.2.0-5.1.mga4 freeradius-yubikey-2.2.0-5.1.mga4 libfreeradius1-2.2.0-5.1.mga4 libfreeradius-devel-2.2.0-5.1.mga4 freeradius-web-2.2.0-5.1.mga4 from SRPMS: freeradius-2.2.0-4.1.mga3.src.rpm freeradius-2.2.0-5.1.mga4.src.rpm
Assignee: bugsquad => qa-bugsSeverity: normal => major
No simple PoC. See bug 8726 for test procedure.
Whiteboard: MGA3TOO => MGA3TOO has_procedure
In VirtualBox, M3, KDE, 32-bit Package(s) under test: freeradius default updated install of freeradius [root@localhost wilcal]# urpmi freeradius Package freeradius-2.2.0-4.mga3.i586 is already installed ran simple tests as described in: http://freeradius.org/doc/ [root@localhost wilcal]# radiusd -X freeradius seems to be responding. Added testing Cleartext-Password := "password" to /etc/raddb/users [root@localhost wilcal]# radtest testing password 127.0.0.1 0 testing123 freeradius seems to be responding. install freeradius from updates_testing [root@localhost wilcal]# urpmi freeradius Package freeradius-2.2.0-4.1.mga3.i586 is already installed ran simple tests as described in: http://freeradius.org/doc/ [root@localhost wilcal]# radiusd -X freeradius seems to be responding. Added testing Cleartext-Password := "password" to /etc/raddb/users [root@localhost wilcal]# radtest testing password 127.0.0.1 0 testing123 freeradius seems to be responding. Test platform: Intel Core i7-2600K Sandy Bridge 3.4GHz GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB RTL8111/8168B PCI Express 1Gbit Ethernet DRAM 16GB (4 x 4GB) Mageia 4 64-bit, Nvidia driver VirtualBox 4.3.6-1.mga4.x86_64.rpm
CC: (none) => wilcal.intWhiteboard: MGA3TOO has_procedure => MGA3TOO has_procedure MGA3-32-OK
In VirtualBox, M3, KDE, 64-bit Package(s) under test: freeradius default updated install of freeradius [root@localhost wilcal]# urpmi freeradius Package freeradius-2.2.0-4.mga3.x86_64 is already installed ran simple tests as described in: http://freeradius.org/doc/ [root@localhost wilcal]# radiusd -X freeradius seems to be responding. Added to /etc/raddb/users [root@localhost wilcal]# radtest testing password 127.0.0.1 0 testing123 freeradius seems to be responding. install freeradius from updates_testing [root@localhost wilcal]# urpmi freeradius Package freeradius-2.2.0-4.1.mga3.x86_64 is already installed ran simple tests as described in: http://freeradius.org/doc/ [root@localhost wilcal]# radiusd -X freeradius seems to be responding. Added testing Cleartext-Password := "password" to /etc/raddb/users [root@localhost wilcal]# radtest testing password 127.0.0.1 0 testing123 freeradius seems to be responding. Test platform: Intel Core i7-2600K Sandy Bridge 3.4GHz GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB RTL8111/8168B PCI Express 1Gbit Ethernet DRAM 16GB (4 x 4GB) Mageia 4 64-bit, Nvidia driver VirtualBox 4.3.6-1.mga4.x86_64.rpm
Whiteboard: MGA3TOO has_procedure MGA3-32-OK => MGA3TOO has_procedure MGA3-32-OK MGA3-64-OK
In VirtualBox, M4, KDE, 32-bit Package(s) under test: freeradius default updated install of freeradius [root@localhost wilcal]# urpmi freeradius Package freeradius-2.2.0-5.mga4.i586 is already installed ran simple tests as described in: http://freeradius.org/doc/ [root@localhost wilcal]# radiusd -X freeradius seems to be responding. Added testing Cleartext-Password := "password" to /etc/raddb/users [root@localhost wilcal]# radtest testing password 127.0.0.1 0 testing123 freeradius seems to be responding. install freeradius from updates_testing [root@localhost wilcal]# urpmi freeradius Package freeradius-2.2.0-5.1.mga4.i586 is already installed ran simple tests as described in: http://freeradius.org/doc/ [root@localhost wilcal]# radiusd -X freeradius seems to be responding. Added testing Cleartext-Password := "password" to /etc/raddb/users [root@localhost wilcal]# radtest testing password 127.0.0.1 0 testing123 freeradius seems to be responding. Test platform: Intel Core i7-2600K Sandy Bridge 3.4GHz GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB RTL8111/8168B PCI Express 1Gbit Ethernet DRAM 16GB (4 x 4GB) Mageia 4 64-bit, Nvidia driver VirtualBox 4.3.6-1.mga4.x86_64.rpm
Whiteboard: MGA3TOO has_procedure MGA3-32-OK MGA3-64-OK => MGA3TOO has_procedure MGA3-32-OK MGA3-64-OK MGA4-32-OK
In VirtualBox, M4, KDE, 64-bit Package(s) under test: freeradius default updated install of freeradius [root@localhost wilcal]# urpmi freeradius Package freeradius-2.2.0-5.mga4.x86_64 is already installed ran simple tests as described in: http://freeradius.org/doc/ [root@localhost wilcal]# radiusd -X freeradius seems to be responding. Added testing Cleartext-Password := "password" to /etc/raddb/users [root@localhost wilcal]# radtest testing password 127.0.0.1 0 testing123 freeradius seems to be responding. install freeradius from updates_testing [root@localhost wilcal]# urpmi freeradius Package freeradius-2.2.0-5.1.mga4.x86_64 is already installed ran simple tests as described in: http://freeradius.org/doc/ [root@localhost wilcal]# radiusd -X freeradius seems to be responding. Added testing Cleartext-Password := "password" to /etc/raddb/users [root@localhost wilcal]# radtest testing password 127.0.0.1 0 testing123 freeradius seems to be responding. Test platform: Intel Core i7-2600K Sandy Bridge 3.4GHz GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB RTL8111/8168B PCI Express 1Gbit Ethernet DRAM 16GB (4 x 4GB) Mageia 4 64-bit, Nvidia driver VirtualBox 4.3.6-1.mga4.x86_64.rpm
Whiteboard: MGA3TOO has_procedure MGA3-32-OK MGA3-64-OK MGA4-32-OK => MGA3TOO has_procedure MGA3-32-OK MGA3-64-OK MGA4-32-OK MGA4-64-OK
For me this update works fine as best I can test it. I think someone can make a career out of understanding this Go ahead and push it.
Validating update, advisory has been uploaded. Please push to 3 & 4 core/updates.
Keywords: (none) => validated_updateWhiteboard: MGA3TOO has_procedure MGA3-32-OK MGA3-64-OK MGA4-32-OK MGA4-64-OK => MGA3TOO has_procedure MGA3-32-OK MGA3-64-OK MGA4-32-OK MGA4-64-OK advisoryCC: (none) => remi, sysadmin-bugs
Update pushed: http://advisories.mageia.org/MGASA-2014-0088.html
Status: NEW => RESOLVEDCC: (none) => tmbResolution: (none) => FIXED
URL: (none) => http://lwn.net/Vulnerabilities/588047/