Bug 475128 – dev-php/pecl-radius: Security flaw in radius_get_vendor_attr() (CVE-2013-2220)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2013-06-28 17:44:33 UTC]

From ${URL} :

  PHP PECL upstream has released 1.2.7 version of the Radius
client library, correcting one security flaw (from [1]):

"- Fix a security issue in radius_get_vendor_attr() by enforcing checks of the
VSA length field against the buffer size. (Adam)"

References:
[1] http://pecl.php.net/package-changelog.php?package=radius
[2] http://pecl.php.net/news/

Relevant upstream patch:
[3] https://github.com/LawnGnome/php-radius/commit/13c149b051f82b709e8d7cc32111e84b49d57234


@maintainer(s): after the bump, in case we need to stabilize the package, please say explicitly if it is ready for the stabilization or not.

[Comment 1 GLSAMaker/CVETool Bot 2013-08-27 03:33:04 UTC]

CVE-2013-2220 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-2220):
  Buffer overflow in the radius_get_vendor_attr function in the Radius
  extension before 1.2.7 for PHP allows remote attackers to cause a denial of
  service (crash) and possibly execute arbitrary code via a large Vendor
  Specific Attributes (VSA) length value.

[Comment 2 Brian Evans (RETIRED) 2014-09-30 14:38:04 UTC]

The ebuild exists in the tree and old versions are removed.

Security team can continue from here.

[Comment 3 Brian Evans (RETIRED) 2015-02-04 20:46:30 UTC]

Security: this is ready for your attention.

[Comment 4 Mikle Kolyada (RETIRED) 2015-03-18 17:54:51 UTC]

No glsa for testing branch