Rapid7 Vulnerability & Exploit Database

RHSA-2002:030: Updated radiusd-cistron packages are available

Back to Search

RHSA-2002:030: Updated radiusd-cistron packages are available

Severity
8
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
03/04/2002
Created
07/25/2018
Added
03/24/2010
Modified
07/04/2017

Description

Updated radiusd-cistron packages, which fix various security issues, are now available.

The radiusd-cistron package contains a server daemon for the Remote Authentication Dial-In User Server (RADIUS) client/server security protocol. Various vulnerabilities have been found in Cistron RADIUS as well as other RADIUS servers and clients. In versions of Cistron RADIUS 1.6.5 and earlier, malformed packets could be used to gain additional privileges. All users of Cistron RADIUS are advised to upgrade to version 1.6.6, which is not vulnerable to these issues. Pay special attention to the installation instructions in the Solution section as they vary significantly from the usual update method.

Solution(s)

  • redhat-upgrade-radiusd-cistron

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;