CVE-2020-8597
CVE-2020-8597
This page contains facts from public vulnerability sources. Check the original advisory before updating.
eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.
CVSS 9.8 · Critical · EPSS 19.9% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
lwip Debian:12
- Affected ranges
- ECOSYSTEM: < 2.1.2+dfsg1-5
Update to 2.1.2+dfsg1-5
lwip Debian:13
- Affected ranges
- ECOSYSTEM: < 2.1.2+dfsg1-5
Update to 2.1.2+dfsg1-5
lwip Debian:14
- Affected ranges
- ECOSYSTEM: < 2.1.2+dfsg1-5
Update to 2.1.2+dfsg1-5
ppp Debian:12
- Affected ranges
- ECOSYSTEM: < 2.4.8-1+1
Update to 2.4.8-1+1
ppp Debian:13
- Affected ranges
- ECOSYSTEM: < 2.4.8-1+1
Update to 2.4.8-1+1
ppp Debian:14
- Affected ranges
- ECOSYSTEM: < 2.4.8-1+1
Update to 2.4.8-1+1
ppp Ubuntu:Pro:14.04:LTS
- Versions
- 2.4.5-5.1ubuntu2
- 2.4.5-5.1ubuntu2.1
- 2.4.5-5.1ubuntu2.2
- 2.4.5-5.1ubuntu2.3
- Affected ranges
- ECOSYSTEM: < 2.4.5-5.1ubuntu2.3+esm1
Update to 2.4.5-5.1ubuntu2.3+esm1
ppp Ubuntu:16.04:LTS
- Versions
- 2.4.6-3.1ubuntu1
- 2.4.7-1+1ubuntu1
- 2.4.7-1+2ubuntu1
- 2.4.7-1+2ubuntu1.16.04.1
- Affected ranges
- ECOSYSTEM: < 2.4.7-1+2ubuntu1.16.04.2
Update to 2.4.7-1+2ubuntu1.16.04.2
ppp Ubuntu:18.04:LTS
- Versions
- 2.4.7-1+2ubuntu1
- 2.4.7-1+4ubuntu1
- 2.4.7-1+4ubuntu3
- 2.4.7-2+1ubuntu1
- 2.4.7-2+2ubuntu1
- 2.4.7-2+2ubuntu1.1
- Affected ranges
- ECOSYSTEM: < 2.4.7-2+2ubuntu1.2
Update to 2.4.7-2+2ubuntu1.2
ppp Ubuntu:20.04:LTS
- Versions
- 2.4.7-2+4.1ubuntu4
- Affected ranges
- ECOSYSTEM: < 2.4.7-2+4.1ubuntu5
Update to 2.4.7-2+4.1ubuntu5
lwip Ubuntu:Pro:20.04:LTS
- Versions
- 2.1.2-3
- 2.1.2-5.1
- 2.1.2+dfsg1-1
- 2.1.2+dfsg1-4
- Affected ranges
- ECOSYSTEM: < 2.1.2+dfsg1-4ubuntu0.1~esm1
Update to 2.1.2+dfsg1-4ubuntu0.1~esm1
Original sources
- https://github.com/paulusmack/ppp/commit/8d7970b8f3db727fe798b65f3377fe6787575426
- https://lists.debian.org/debian-lts-announce/2020/02/msg00005.html
- https://www.debian.org/security/2020/dsa-4632
- https://access.redhat.com/errata/RHSA-2020:0631
- https://access.redhat.com/errata/RHSA-2020:0634
- https://access.redhat.com/errata/RHSA-2020:0633
- https://access.redhat.com/errata/RHSA-2020:0630
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00006.html
- https://usn.ubuntu.com/4288-1/
- https://www.kb.cert.org/vuls/id/782301
- http://seclists.org/fulldisclosure/2020/Mar/6
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UNJNHWOO4XF73M2W56ILZUY4JQG3JXIR/
- http://packetstormsecurity.com/files/156662/pppd-2.4.8-Buffer-Overflow.html
- https://www.synology.com/security/advisory/Synology_SA_20_02
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOFDAIOWSWPG732ASYUZNINMXDHY4APE/
- https://security.netapp.com/advisory/ntap-20200313-0004/
- https://security.gentoo.org/glsa/202003-19
- https://usn.ubuntu.com/4288-2/
- http://packetstormsecurity.com/files/156802/pppd-2.4.8-Buffer-Overflow.html
- https://kb.netgear.com/000061806/Security-Advisory-for-Unauthenticated-Remote-Buffer-Overflow-Attack-in-PPPD-on-WAC510-PSV-2020-0136
- https://cert-portal.siemens.com/productcert/pdf/ssa-809841.pdf
- https://us-cert.cisa.gov/ics/advisories/icsa-20-224-04
- https://nvd.nist.gov/vuln/detail/CVE-2020-8597