Описание
The code in pppd that formats a response to a PEAP Request packet in peap_response() copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacket_buf
without checking the available space and without implementing outgoing
PEAP fragmentation. Thus a pppd process connecting to a server which
requests PEAP authentication can be induced to corrupt global static
data following the outpacket_buf array, most likely causing incorrect behavior or a crash.
A flaw was found in pppd. A remote attacker could exploit a buffer overflow vulnerability in the PEAP response handling. By sending a specially crafted PEAP Request packet, an attacker could cause the pppd process to corrupt global static data, leading to incorrect behavior or a system crash.
Отчет
This vulnerability is rated as Moderate impact because successful exploitation requires an adjacent peer to manipulate authentication exchanges against an active client connection, rather than allowing unauthenticated remote attacks against a listening service. In typical Red Hat Enterprise Linux deployments, the Point-to-Point Protocol daemon (pppd) is not enabled by default and is only invoked when specific dial-up, broadband, or VPN links are configured. Systems remain unaffected unless they actively establish a connection to an untrusted or compromised server that demands PEAP authentication.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | ppp | Fix deferred | ||
| Red Hat Enterprise Linux 6 | ppp | Fix deferred | ||
| Red Hat Enterprise Linux 7 | ppp | Fix deferred | ||
| Red Hat Enterprise Linux 8 | ppp | Fix deferred | ||
| Red Hat Enterprise Linux 9 | ppp | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
6.8 Medium
CVSS3
Связанные уязвимости
The code in pppd that formats a response to a PEAP Request packet in peap_response() copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacket_buf without checking the available space and without implementing outgoing PEAP fragmentation. Thus a pppd process connecting to a server which requests PEAP authentication can be induced to corrupt global static data following the outpacket_buf array, most likely causing incorrect behavior or a crash.
A flaw was found in pppd. A remote attacker could exploit a buffer overflow vulnerability in the PEAP response handling. By sending a specially crafted PEAP Request packet, an attacker could cause the pppd process to corrupt global static data, leading to incorrect behavior or a system crash.
A flaw was found in pppd. A remote attacker could exploit a buffer ove ...
ALT-PU-2026-16225: package `NetworkManager-l2tp` update to version 1.52.6-alt0.p10.1
ALT-PU-2026-16090: package `NetworkManager-l2tp` update to version 1.52.6-alt1
EPSS
6.8 Medium
CVSS3