[37190] in bugtraq
Re: [ GLSA 200411-01 ] ppp: Remote denial of service vulnerability
daemon@ATHENA.MIT.EDU (Paul Mackerras)
Tue Nov 2 13:12:25 2004
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <16774.49886.264509.824857@cargo.ozlabs.ibm.com>
Date: Tue, 2 Nov 2004 10:12:30 +1100
From: Paul Mackerras <paulus@samba.org>
To: Luke Macken <lewk@gentoo.org>
Cc: gentoo-announce@gentoo.org, bugtraq@securityfocus.com,
full-disclosure@lists.netsys.com, security-alerts@linuxsecurity.com
In-Reply-To: <1099329711.11514.24.camel@tomservo.rh.rit.edu>
Luke Macken writes:
> The pppd server improperly verifies header fields, making it vulnerable
> to denial of service attacks.
>
> Impact
> ======
>
> An attacker can cause the pppd server to access memory that it isn't
> allowed to, causing the server to crash. No code execution is possible
> with this vulnerability, because no data is getting copied.
Furthermore, only the connection to the attacker will be affected,
since a separate pppd process handles each ppp connection. In other
words, an attacker can terminate their own connection, but they can
not affect any other connection, or prevent new connections from being
established. Given that, I don't think that this is even a DoS
vulnerability.
Paul.
