SECURITY

USN-3316-1: FreeRADIUS vulnerability Ubuntu Security Notice USN-3316-1 7th June, 2017 freeradius vulnerability A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 17.04 Summary FreeRADIUS would allow unintended access over the network. Software description freeradius – high-performance and highly configurable RADIUS server Details Stefan Winter and Luboš Pavlíček discovered that FreeRADIUS incorrectlyhandled the TLS session cache. A remote attacker could possibly use thisissue to bypass authentication by resuming an unauthenticated session. Update instructions The problem can be corrected by updating your system to the following package version: Ubuntu 17.04: freeradius 3.0.12+dfsg-4ubuntu1.1 To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. In general, a standard system update will make all the necessary changes. References CVE-2017-9148 Source: USN-3316-1: FreeRADIUS vulnerability

USN-3253-2: Nagios regression Ubuntu Security Notice USN-3253-2 7th June, 2017 nagios3 regression A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 17.04 Ubuntu 16.10 Ubuntu 16.04 LTS Ubuntu 14.04 LTS Summary USN-3253-1 introduced a regression in Nagios. Software description nagios3 – host/service/network monitoring and management system Details USN-3253-1 fixed vulnerabilities in Nagios. The update prevented log filesfrom being displayed in the web interface. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that Nagios incorrectly handled certain long strings. A remote authenticated attacker could use this issue to cause Nagios to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2013-7108, CVE-2013-7205) It was discovered that Nagios incorrectly handled certain long messages to cmd.cgi. A remote attacker could possibly use this issue to cause Nagios to crash, [ more… ]