[29735] in bugtraq
Re: PoPToP PPTP server remotely exploitable buffer overflow
daemon@ATHENA.MIT.EDU (Dick St.Peters)
Thu Apr 10 20:47:37 2003
From: "Dick St.Peters" <stpeters@NetHeaven.com>
Message-ID: <16021.39673.135783.341881@saint.heaven.net>
Date: Thu, 10 Apr 2003 12:25:29 -0400
To: Timo Sirainen <tss@iki.fi>
In-Reply-To: <1049905172.25106.323.camel@hurina>
Timo Sirainen writes:
> Versions older than 1.1.4-b3 and 1.1.3-20030409 affected. This seems to be
> exploitable only with Linux.
...
> problem
> -------
...
>
> if (length > PPTP_MAX_CTRL_PCKT_SIZE) {
> // abort
> }
Version 1.1.3 does not have this vulnerability. My copy of 1.1.3
ctrlpacket.c (dated Feb 11 2002) reads
if (length <= 0 || length > PPTP_MAX_CTRL_PCKT_SIZE) {
My copies of versions 1.0.1 and 1.1.2 do have the vulerability.
--
Dick St.Peters, stpeters@NetHeaven.com
