oss-security - CVE request for buffer overflow in ppp

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150413111123.GU1846@frisco.mine.nu>
Date: Mon, 13 Apr 2015 13:11:23 +0200
From: Sébastien Delafond <seb@...ian.org>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: CVE request for buffer overflow in ppp

Hi,

the Debian Security Team is requesting a CVE for a buffer overflow issue
in ppp, described in the Debian BTS:

  https://bugs.debian.org/782450

This has DoS implications, as detailed by the initial reporter:

  Moreover, when ppp is compiled with GCC's Object Size Checking
  Built-in Functions, the call to sprintf gets replaced by
  __sprintf_chk():
  https://gcc.gnu.org/onlinedocs/gcc/Object-Size-Checking.html

  If that is the case, pppd consistently crashes with a SIGABRT upon
  successful authentication if its own pid is greater than 65535.

  https://bugs.launchpad.net/ubuntu/+source/ppp/+bug/291743

  As you can see from the reports, pppd's pid is always greater than
  65535. Users complain that the bug shows up "after a few hours".

  A possible attack scenario against a VPN server running xl2tpd
  follows.

  xl2tpd starts a new pppd process for each connection attempt. A remote
  attacker could repeatedly connect to the remote server, even with
  invalid credentials, in order to increase the pid of pppd at every
  attempt. After pppd's pid reaches 65535, each and every subsequent
  connection attempt would fail, resulting in a denial of service.

Cheers,

--Seb

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.