RHBA-2009:1678 - Bug Fix Advisory

Topic

Updated freeradius packages that fix a bug are now available.

Description

FreeRADIUS is an Internet authentication daemon, which implements the
RADIUS protocol, as defined in RFC 2865 (and others). It allows Network
Access Servers (NAS boxes) to perform authentication for dial-up users.
There are also RADIUS clients available for Web servers, firewalls, Unix
logins, and more. Using RADIUS allows authentication and authorization for
a network to be centralized, and minimizes the amount of re-configuration
which has to be done when adding or deleting new users.

This update addresses the following bug:

• an error in the EAP authentication module could cause memory corruption.

Running the radeapclient utility would typically expose the problem. An
error message including text such as this

• ** glibc detected *** radeapclient: free(): invalid pointer:

presented and radeapclient would then abort abnormally. This update
corrects the error in the EAP authentication module. The module no longer
corrupts memory and applications such as radeapclient that use this module
work as expected. (BZ#476513)

All freeradius users should install these updated packages, which fix this
problem.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 476513 - radeapclient on x86_64 *** glibc detected *** radeapclient: free(): invalid pointer: On RHEL5 x86_64

CVEs

(none)

References

(none)