PPP is the protocol used for establishing internet links over dial-up modems,DSL connections,and many other types of point-to-point links including Virtual Private Networks(VPN)such as Point to Point Tunneling Protocol(PPTP). The pppd software can also authenticate a network connected peer and/or supply authentication information to the peer using multiple authentication protocols including EAP. Due to a flaw in the Extensible Authentication Protocol(EAP)packet processing in the Point-to-Point Protocol Daemon(pppd),an unauthenticated remote attacker may be able to cause a stack buffer overflow,which may allow arbitrary code execution on the target system. This vulnerability is due to an error in validating the size of the input before copying the supplied data into memory. As the validation of the data size is incorrect,arbitrary data can be copied into memory and cause memory corruption possibly leading to execution of unwanted code. The vulnerability is in the logic of the eap parsing code,specifically in the eap_request()and eap_response()functions in eap.c that are called by a network input handler. These functions take a pointer and length as input using the the first byte as a type. If the type is EAPT_MD5CHAP(4),it looks at an embedded 1-byte length field. The logic in this code is intended to makes sure that embedded length is smaller than the whole packet length. After this verification,it tries to copy provided data(hostname)that is located after the embedded length field into a local stack buffer. This bounds check is incorrect and allows for memory copy to happen with an arbitrary length of data. An additional logic flaw causes the eap_input()function to not check if EAP has been negotiated during the Line Control Protocol(LCP)phase. This allows an unauthenticated attacker ..
Support the originator by clicking the read the rest link below.
