Bugzilla Bug 127229

2006.03.20
v1.0.5, and v1.1.0 
A validation issue exists with the EAP-MSCHAPv2 module in all versions from
1.0.0 (where the module first appeared) to 1.1.0. Insufficient input validation
was being done in the EAP-MSCHAPv2 state machine. A malicious attacker could
manipulate their EAP-MSCHAPv2 client state machine to potentially convince the
server to bypass authentication checks. This bypassing could also result in the
server crashing. We recommend that administrators upgrade immediately.

mrness, pls provide an updated ebuild

I would love to, but freeradius-1.1.1 is uncompilable (compilation breaks at
rlm_eap module). 
I've managed to fix some problems, but I still have 2 more left on this module:
linker fails to find radius_xlat and log_debug symbols. It's kinda strange
those functions are used here, since they are defined in radiusd daemon not the
radius library.

Seems it will take awhile.

I've reported the rlm_eap compilation problems to upstream (see
http://bugs.freeradius.org/show_bug.cgi?id=350).

any progress on this one?

Yes, I've spoked with upstream on freeradius-devel@lists.freeradius.org.

It could be build if I would not patch the rlm_eap  makefile at all and drop
--disable-static from .configure command line.
I don't like this, but is the only way. I will bump it today.

the new version has been commited, with the same keywords as the 1.1.0-r1 (I've
tested myself on x86 and amd64).

sorry for the delay, but this bump was horrible. I'm still not perfectly happy
with the results because I had to remove --disable-static from configure cmd
line in order to make it work.

Thx Alin, this one is ready for GLSA decision. I tend to vote YES.

vote Yes, sure.

Do not forget that the old version isn't vulnerable to DoS attacks on Gentoo. 
The init script use radwatch script, which restart radiusd daemon if it dies.

The important part for me here is "A malicious attacker could
manipulate their EAP-MSCHAPv2 client state machine to potentially convince the
server to bypass authentication checks."

I'm only saying this for keeping "DoS" word out from the GLSA.

0.5 vote for a glsa

Given the scope of freeradius use, I vote yes.

GLSA 200604-03

thanks everyone