RHBA-2012:0881 - Bug Fix Advisory

Topic

Updated freeradius packages that fix several bugs and add various enhancements
are now available for Red Hat Enterprise Linux 6.

Description

FreeRADIUS is an open-source Remote Authentication Dial In User Service (RADIUS)
server which allows RADIUS clients to perform authentication against the RADIUS
server. The RADIUS server may optionally perform accounting of its operations
using the RADIUS protocol.

The freeradius packages have been upgraded to upstream version 2.1.12, which
provides a number of bug fixes and enhancements over the previous version.
(BZ#736878)

This update fixes the following bugs:

• The radtest command-line argument to request the PPP hint option was not

parsed correctly. Consequently, radclient did not add the PPP hint to the
request packet and the test failed. This update corrects the problem and radtest
now functions as expected. (BZ#787116)

• After log rotation, the freeradius logrotate script failed to reload the

radiusd daemon after a log rotation and log messages were lost. This update has
added a command to the freeradius logrotate script to reload the radiusd daemon
and the radiusd daemon reinitializes and reopens its log files after log
rotation as expected. (BZ#705723)

• The radtest argument with the eap-md5 option failed because it passed the IP

family argument when invoking the radeapclient utility and the radeapclient
utility did not recognize the IP family. The radeapclient now recognizes the IP
family argument and radtest now works with eap-md5 as expected. (BZ#712803)

• Previously, freeradius was compiled without the "--with-udpfromto" option.

Consequently, with a multihomed server and explicitly specifying the IP address,
freeradius sent the reply from the wrong IP address. With this update,
freeradius has been built with the --with-udpfromto configuration option and the
RADIUS reply is always sourced from the IP the request was sent to. (BZ#700870)

• The password expiration field for local passwords was not checked by the unix

module and the debug information was erroneous. Consequently, a user with an
expired password in the local password file was authenticated despite having an
expired password. With this update, check of the password expiration has been
modified. A user with an expired local password is denied access and correct
debugging information is written to the log file. (BZ#753764)

• Due to invalid syntax in the PostgreSQL admin schema file, the FreeRADIUS

PostgreSQL tables failed to be created. With this update, the syntax has been
adjusted and the tables are created as expected. (BZ#690756)

• When FreeRADIUS received a request, it sometimes failed with the following

message:

WARNING: Internal sanity check failed in event handler for request 6

This bug was fixed by upgrading to upstream version 2.1.12. (BZ#782905)

• FreeRADIUS has a thread pool that will dynamically grow based on load. If

multiple threads using the rlm_perl() function are spawned in quick succession,
freeradius sometimes terminated unexpectedly with a segmentation fault due to
parallel calls to the rlm_perl_clone() function. With this update, mutex for the
threads has been added and the problem no longer occurs. (BZ#810605)

All users of freeradius are advised to upgrade to these updated packages, which
fix these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 690756 - possible errors in /etc/raddb/sql/postgresql/admin.sql template
• BZ - 700870 - freeradius not compiled with --with-udpfromto
• BZ - 705723 - freeradius logrotate script does not reload running daemon, causing log files not written after logrotate
• BZ - 712803 - radtest script is not working with eap-md5 option
• BZ - 753764 - shadow password expiration does not work in freeradius 2.1.10
• BZ - 782905 - Requests fails with "Internal sanity check failed" message
• BZ - 787116 - radtest PPPhint option is not parsed properly
• BZ - 810605 - Segfault with freeradius-perl threading

CVEs

• CVE-2011-4966

References

(none)