CVE-2015-3310 Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial...
MediumCVSS 4.3
EPSS 5.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial of service (crash) via a start accounting message to the RADIUS server.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/ppp(Debian:12) | < 2.4.6-3.1 | 2.4.6-3.1 |
| debian/ppp(Debian:13) | < 2.4.6-3.1 | 2.4.6-3.1 |
| debian/ppp(Debian:14) | < 2.4.6-3.1 | 2.4.6-3.1 |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.10 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| point-to-point protocol project point-to-point protocol | <= 2.4.6 | No fix listed |
References
- MSRC Security Update Guide vendor-advisory
- Debian Security Tracker CVE-2015-3310 vendor-advisory
- advisories.mageia.org
- openSUSE-SU-2015:2121 vendor-advisory
- DSA-3228 vendor-advisory
- MDVSA-2015:222 vendor-advisory
- 74163 vdb-entry
- USN-2595-1 vendor-advisory
- bugs.debian.org
- GLSA-201701-50 vendor-advisory
- bugs.debian.org issue-tracking