MDKSA-2007:092

[ursula]

Mandriva Advisories
Package name freeradius
Date April 23rd, 2007
Advisory ID MDKSA-2007:092
Affected versions CS4.0
Synopsis Updated freeradius packages fix vulnerability


Problem Description

Multiple buffer overflows were found in the FreeRADIUS package version
1.0.4 and prior that could allow a remote attacker to cause a crash
via the rlm_sqlcounter module (CVE-2005-4746).

As well, an SQL injection vulnerability was also found in the
rlm_sqlcounter that could allow a remote attacker to execute arbitrary
SQL commands via unknown attack vectors (CVE-2005-4745).

Updated packages have been patched to correct this issue.