Bugtraq mailing list archives
Re: PoPToP PPTP server remotely exploitable buffer overflow
From: "Dick St.Peters" <stpeters () NetHeaven com>
Date: Thu, 10 Apr 2003 12:25:29 -0400
Timo Sirainen writes:
Versions older than 1.1.4-b3 and 1.1.3-20030409 affected. This seems to be exploitable only with Linux.
...
problem -------
...
if (length > PPTP_MAX_CTRL_PCKT_SIZE) { // abort }
Version 1.1.3 does not have this vulnerability. My copy of 1.1.3 ctrlpacket.c (dated Feb 11 2002) reads if (length <= 0 || length > PPTP_MAX_CTRL_PCKT_SIZE) { My copies of versions 1.0.1 and 1.1.2 do have the vulerability. -- Dick St.Peters, stpeters () NetHeaven com
Current thread:
- PoPToP PPTP server remotely exploitable buffer overflow Timo Sirainen (Apr 09)
- Re: PoPToP PPTP server remotely exploitable buffer overflow Dick St.Peters (Apr 10)