Summary
The remote host is missing updates announced in
advisory GLSA 200505-13.
Solution
All FreeRADIUS users should upgrade to the latest available version:
# emerge --sync
# emerge --ask --oneshot --verbose '>=net-dialup/freeradius-1.0.2-r4'
http://www.securityspace.com/smysecure/catid.html?in=GLSA%20200505-13 http://bugs.gentoo.org/show_bug.cgi?id=91736
http://www.securityfocus.com/bid/13540/
http://www.securityfocus.com/bid/13541/
Insight
The FreeRADIUS server is vulnerable to an SQL injection attack and a buffer overflow, possibly resulting in disclosure and modification of data and Denial of Service.
Severity
Classification
-
CVE CVE-2005-1454, CVE-2005-1455 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities