Hi Peter, 
we received this through vendor-sec. 
 
To: Free Software Distribution Vendors <vendor-sec@lst.de> 
User-Agent: Mutt/1.5.6+20040907i 
Subject: [vendor-sec] CAN-2005-0108: Denial of service in 
mod_auth_radius and pam_radius_auth 
Errors-To: vendor-sec-admin@lst.de 
Date: Wed, 19 Jan 2005 08:29:42 +0100 
 
Leon Juranic discoverd an integer underflow in the mod_auth_radius 
module for Apache which is also present in libpam-radius-auth. 
 
Apache mod_auth_radius 1.5.4 allows remote malicious RADIUS servers to 
cause a denial of service (crash) via a RADIUS_REPLY_MESSAGE with a 
RADIUS attribute length of 1, which leads to a memcpy operation with a 
-1 length argument. 
 
Details: 
http://marc.theaimsgroup.com/?l=bugtraq&m=110548193312050&w=2 
 
This one is public already.  Patch attached. 
 
Regards, 
 
        Joey 
 
-- 
Ten years and still binary compatible.  -- XFree86 
 
--- libpam-radius-auth-1.3.14.orig/pam_radius_auth.c 
+++ libpam-radius-auth-1.3.14/pam_radius_auth.c 
[...]