ppxp does not drop root privileges before opening log files, which allows local users to execute arbitrary commands.

This advisory adds security support for the stable amd64 distribution.
It covers all security updates since the release of sarge, which were missing updated packages for the not yet official amd64 port. Future security advisories will include updates for this port as well.

A Debian Advisory reports :

Jens Steube discovered that ppxp, yet another PPP program, does not release root privileges when opening potentially user-supplied log files. This can be tricked into opening a root shell.

Jens Steube discovered that ppxp, yet another PPP program, does not release root privileges when opening potentially user-supplied log files. This can be tricked into opening a root shell.

ID	Name	Product	Family	Severity
57528	Debian DSA-773-1 : amd64 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
56493	FreeBSD : ppxp -- local root exploit (641e8609-cab5-11d9-9aed-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	high
18304	Debian DSA-725-2 : ppxp - missing privilege release	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2005-0392

high

Tenable Plugins

critical

high

high