Date: Mon, 13 Apr 2015 13:11:23 +0200 From: Sébastien Delafond <seb@...ian.org> To: oss-security@...ts.openwall.com Cc: cve-assign@...re.org Subject: CVE request for buffer overflow in ppp Hi, the Debian Security Team is requesting a CVE for a buffer overflow issue in ppp, described in the Debian BTS: https://bugs.debian.org/782450 This has DoS implications, as detailed by the initial reporter: Moreover, when ppp is compiled with GCC's Object Size Checking Built-in Functions, the call to sprintf gets replaced by __sprintf_chk(): https://gcc.gnu.org/onlinedocs/gcc/Object-Size-Checking.html If that is the case, pppd consistently crashes with a SIGABRT upon successful authentication if its own pid is greater than 65535. https://bugs.launchpad.net/ubuntu/+source/ppp/+bug/291743 As you can see from the reports, pppd's pid is always greater than 65535. Users complain that the bug shows up "after a few hours". A possible attack scenario against a VPN server running xl2tpd follows. xl2tpd starts a new pppd process for each connection attempt. A remote attacker could repeatedly connect to the remote server, even with invalid credentials, in order to increase the pid of pppd at every attempt. After pppd's pid reaches 65535, each and every subsequent connection attempt would fail, resulting in a denial of service. Cheers, --Seb
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ