RHBA-2008:0845 - Bug Fix Advisory

Topic

Updated freeradius packages that fix various bugs are now available.

Description

FreeRADIUS is a high-performance and highly-configurable free Remote
Authentication Dial In User Service (RADIUS) server, designed to allow
centralized authentication and authorization for a network.

These updated packages fix the following bugs:

• previously, FreeRADIUS sent empty fragments in EAP-TLS transactions.

Although most clients accepted the empty fragments, in certain situations,
Windows Vista(r) clients did not. This may have caused authentication to
fail. The SSL configuration parameters that FreeRADIUS uses have been
updated to no longer send empty fragments, allowing EAP-TLS with Windows
Vista clients.

• setting the "tls_require_cert" parameter in the radius.conf configuration

file to any valid value resulted in the following error message in the
/var/log/radius/radius.log file: "Error: rlm_ldap: could not set
LDAP_OPT_X_TLS_REQUIRE_CERT option to allow". In these updated packages,
setting the "tls_require_cert" parameter in radius.conf works as expected,
and does not provoke an error, thus resolving this issue.

• the freeradius RPM spec files had "%{dist}" on the "Release" line,

instead of "%{?dist}".

• FreeRADIUS has SNMP functionality that permits RADIUS authentication and

authorization statistics to be queried and set via SNMP; however, on 64-bit
systems, a persistent connection between FreeRADIUS and the SNMP daemon
(snmpd) could not be established, nor could the SNMP variables in the SNMP
MIB be accessed due to coding errors in the FreeRADIUS SNMP support.
Commands such as "snmpwalk" may have caused snmpd to hang. These updated
packages correct these errors, and permit the FreeRADIUS daemon (radiusd)
to establish a connection -- using the SMUX protocol -- with snmpd, and
permits access to the FreeRADIUS MIB variables via tools such as "snmpwalk"
and "snmpget".

Users of freeradius are advised to upgrade to these updated packages, which
resolve these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 249308 - freeradius (prior to 1.1.4) won't work with vista clients
• BZ - 287381 - rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow
• BZ - 440626 - there should be %{?dist} instead of %{dist} in the *.spec on the Release: line

CVEs

(none)

References

(none)