Advisories » MGASA-2014-0088

Updated freeradius package fixes security vulnerability

Publication date: 21 Feb 2014
Modification date: 21 Feb 2014
Type: security
Affected Mageia releases : 3 , 4
CVE: CVE-2014-2015

Description

SSHA processing in freeradius before 2.2.3 runs into a stack-based buffer
overflow in the freeradius rlm_pap module if the password source uses an
unusually long hashed password (CVE-2014-2015).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=12809
• http://lists.freebsd.org/pipermail/freebsd-bugbusters/2014-February/000610.html
• http://openwall.com/lists/oss-security/2014/02/18/3
• https://bugzilla.redhat.com/show_bug.cgi?id=1066761
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2015

SRPMS

3/core

• freeradius-2.2.0-4.1.mga3

4/core

• freeradius-2.2.0-5.1.mga4