4th March 2002
Horms (Simon Horman) <horms@vergenet.net>

This package includes a patch in response to a vulnerability published
by CERT (http://www.cert.org) in the 4th of March 2002, relating to a
buffer over flow in message digest calculation (VU#589523).

Please note that this package is not vulnerable to a problem
with vender-tags released by CERT at the same time (VU#936683)



5th July 2001
Horms (Simon Horman) <horms@vergenet.net>

This package includes patches in response to a vulnerability published by
Internet Security Systems, Inc. (http://www.iss.net) on the 5th July 2001,
relating to buffer overflows.

In particular the following has been addressed:

* Added header files with function declarations to allow compile-time
  type checking of function calls
* Replaced all calls to strcat() and strncat() with calls to strlcat()
* Replaced all calls to strcpy() and strncpy() with calls to strlcpy()
* Provide an implementation of strlcat() and strlcpy(). The implementation
  included has been taken from the OpenSSL project
  (http://www.openssl.org/).
* Replaced all calls to sprintf() with calls to snprintf().
* Provide C99 compliant implementation of vsnprintf(), snprintf(),
  vasnprintf(), asnprintf() and sprintf(). The implementation included
  has been taken from the Samba project (http://www.samba.org/)
* All fopen() calls preceded by a check to ensure that the filename
  only contains legal character sequences. In particular filenames
  containing ".." will not be opened.
* Removed calls to syslog() and internally defined log_msg()
  where format string may be derived from user input.
* Fixed Segmentaion fault problems in md5test and dbmkeys utilities
* Compiles cleanly with -Wall under Debian Woody as of 5th July 2001


Please note that the resulting code for SecureID, ActivCard and
Ipass have not been tested as I do not have access to the required
header files. This will may be addressed at a later date pending
support from the vendors of these products.

This patch and a more minimal patch is available from:

ftp://ftp.vergenet.net/pub/radius/


This patch has been prepared with the assistance of:

Mark Dowd <mark@vergenet.net>
Wichert Akkerman <wakkerma@debian.org>
Andrew Tridgell <tridge@samba.org>

