Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 13 Apr 2015 13:11:23 +0200
From: S├ębastien Delafond <>
Subject: CVE request for buffer overflow in ppp


the Debian Security Team is requesting a CVE for a buffer overflow issue
in ppp, described in the Debian BTS:

This has DoS implications, as detailed by the initial reporter:

  Moreover, when ppp is compiled with GCC's Object Size Checking
  Built-in Functions, the call to sprintf gets replaced by

  If that is the case, pppd consistently crashes with a SIGABRT upon
  successful authentication if its own pid is greater than 65535.

  As you can see from the reports, pppd's pid is always greater than
  65535. Users complain that the bug shows up "after a few hours".

  A possible attack scenario against a VPN server running xl2tpd

  xl2tpd starts a new pppd process for each connection attempt. A remote
  attacker could repeatedly connect to the remote server, even with
  invalid credentials, in order to increase the pid of pppd at every
  attempt. After pppd's pid reaches 65535, each and every subsequent
  connection attempt would fail, resulting in a denial of service.



Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.