Integer overflow in the getword function in options.c in pppd in Paul's PPP Package (ppp) before 2.4.7 allows attackers to "access privileged options" via a long word in an options file, which triggers a heap-based buffer overflow that "[corrupts] security-relevant variables."

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ppp: integer overflow in option parsing (CVE-2014-3158)

  - Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and     earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial of service     (crash) via a start accounting message to the RADIUS server. (CVE-2015-3310)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ppp: integer overflow in option parsing (CVE-2014-3158)

  - Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and     earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial of service     (crash) via a start accounting message to the RADIUS server. (CVE-2015-3310)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ppp: Remote client crash in ppp EAP-TLS patch (CVE-2018-11574)

  - Integer overflow in the getword function in options.c in pppd in Paul's PPP Package (ppp) before 2.4.7     allows attackers to access privileged options via a long word in an options file, which triggers a heap-     based buffer overflow that [corrupts] security-relevant variables. (CVE-2014-3158)

  - Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and     earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial of service     (crash) via a start accounting message to the RADIUS server. (CVE-2015-3310)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the ppp package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Integer overflow in the getword function in options.c     in pppd in Paul's PPP Package (ppp) before 2.4.7 allows     attackers to 'access privileged options' via a long     word in an options file, which triggers a heap-based     buffer overflow that 'corrupts security-relevant     variables.'(CVE-2014-3158)

  - Buffer overflow in the rc_mksid function in     plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6     and earlier, when the PID for pppd is greater than     65535, allows remote attackers to cause a denial of     service (crash) via a start accounting message to the     RADIUS server.(CVE-2015-3310)

  - eap.c in pppd in ppp 2.4.2 through 2.4.8 has an     rhostname buffer overflow in the eap_request and     eap_response functions.(CVE-2020-8597)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the ppp package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Integer overflow in the getword function in options.c     in pppd in Paul's PPP Package (ppp) before 2.4.7 allows     attackers to 'access privileged options' via a long     word in an options file, which triggers a heap-based     buffer overflow that '[corrupts] security-relevant     variables.'(CVE-2014-3158)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ppp package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Buffer overflow in the rc_mksid function in     plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6     and earlier, when the PID for pppd is greater than     65535, allows remote attackers to cause a denial of     service (crash) via a start accounting message to the     RADIUS server.(CVE-2015-3310)

  - Integer overflow in the getword function in options.c     in pppd in Paul's PPP Package (ppp) before 2.4.7 allows     attackers to 'access privileged options' via a long     word in an options file, which triggers a heap-based     buffer overflow that '[corrupts] security-relevant     variables.'(CVE-2014-3158)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New ppp packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

Updated ppp packages fix security vulnerability :

A vulnerability in ppp before 2.4.7 may enable an unprivileged attacker to access privileged options (CVE-2014-3158).

This updates fixes a potential integer overflow in option parsing.

A user in the group 'dip' could provide a specially crafted configuration file of more than 2G and generate an integer overflow.
This may enable an attacker to overwrite the heap and thereby corrupt security-relevant variables.

See details in the upstream commit:
https://github.com/paulusmack/ppp/commit/7658e8257183f062dc01f87969c14 0707c7e52cb

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201412-19 (PPP: Information disclosure)

    Integer overflow is discovered in the getword function in options.c in       PPP   Impact :

    A local attacker could execute process with extremely long options list,       possibly obtaining sensitive information.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2429-1 advisory.

    It was discovered that ppp incorrectly handled certain options files. A local attacker could possibly use     this issue to escalate privileges.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A vulnerability was discovered in ppp, an implementation of the Point-to-Point Protocol: an integer overflow in the routine responsible for parsing user-supplied options potentially allows a local attacker to gain root privileges.

ppp was updated to fix an integer overflow in option parsing.
(CVE-2014-3158, bnc#891489).

This ppp update fixes a potential security issue that an unprivileged attacker could access privileged options :

  - integer overflow in option parsing (CVE-2014-3158,     bnc#891489)

Security fix for CVE-2014-3158

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198859	RHEL 5 : ppp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198850	RHEL 6 : ppp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198776	RHEL 7 : ppp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
137994	EulerOS Virtualization 3.0.6.0 : ppp (EulerOS-SA-2020-1775)	Nessus	Huawei Local Security Checks	critical
132187	EulerOS 2.0 SP3 : ppp (EulerOS-SA-2019-2652)	Nessus	Huawei Local Security Checks	high
131891	EulerOS 2.0 SP2 : ppp (EulerOS-SA-2019-2399)	Nessus	Huawei Local Security Checks	high
129181	EulerOS 2.0 SP5 : ppp (EulerOS-SA-2019-1987)	Nessus	Huawei Local Security Checks	high
82924	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : ppp (SSA:2015-111-11)	Nessus	Slackware Local Security Checks	high
82388	Mandriva Linux Security Advisory : ppp (MDVSA-2015:135)	Nessus	Mandriva Local Security Checks	high
82219	Debian DLA-74-1 : ppp security update	Nessus	Debian Local Security Checks	high
79972	GLSA-201412-19 : PPP: Information disclosure	Nessus	Gentoo Local Security Checks	high
79659	Ubuntu 14.04 LTS : ppp vulnerability (USN-2429-1)	Nessus	Ubuntu Local Security Checks	high
79627	Debian DSA-3079-1 : ppp - security update	Nessus	Debian Local Security Checks	high
77719	openSUSE Security Update : ppp (openSUSE-SU-2014:1135-1)	Nessus	SuSE Local Security Checks	high
77657	Mandriva Linux Security Advisory : ppp (MDVSA-2014:178)	Nessus	Mandriva Local Security Checks	high
77524	SuSE 11.3 Security Update : ppp (SAT Patch Number 9648)	Nessus	SuSE Local Security Checks	high
77442	Fedora 19 : ppp-2.4.5-33.fc19 (2014-9401)	Nessus	Fedora Local Security Checks	high
77354	Fedora 20 : ppp-2.4.5-34.fc20 (2014-9412)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2014-3158

high

Tenable Plugins

high

high

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high