SecurityTracker Alert ID 1017463

[Alan DeKok]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

  SecurityTracker Alert ID 1017463 was recently brought to our
attention.  Our official statement about this issue is:

- -- Official Vendor Statement from the FreeRADIUS Server project

This issue is not a security  vulnerability.  The exploit is available
only to local administrators who have write access to the server
configuration files.  As such, this issue has no security impact on any
system running FreeRADIUS.

- -- Official Vendor Statement from the FreeRADIUS Server project

  Please update the title and impact fields to indicate that the issue
is NOT remotely exploitable.

  The "solution" is simple: ensure that only authorized users have write
access to the server configuration files.

  We are curious as to why the issue is labelled "remote execution of
code".  The original notification did not claim that the issue was
vulnerable to remote exploit.  If you have any additional data that
causes you to believe it is remotely exploitable, that information
should be supplied to us so we can fix the problem.

  Barring additional data, we believe that the issue is non-existent,
and has no security impact on any system running FreeRADIUS.

  Alan DeKok
  Project Leader
  The FreeRADIUS Server Project
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iQCVAwUBRb3g+6kul4vkAkl9AQL59QP/TO4aw3BpNkr3k3/lFqh2jYCymjEPjC1T
GsVrW3ptuzDqO/JJ9lMWZYVPOjVWcfYWSPJg7COj+cHgDV331wC2feGeeWkgb3lG
SbmX/wv9I+rSTSe3xkTtQL8Fe3tdtNbAaeIIeYx9AhB4c8rv+vO6GKFIXkaEdUq+
7VoUZqykEbk=
=OnAE
-----END PGP SIGNATURE-----