Alex Nichols

**Name of the Vulnerable Software and Affected Versions** Windows Layer 2 Tunneling Protocol (L2TP) (affected versions not specified) **Description** The issue is related to the implementation of the Layer 2 Tunneling Protocol (L2TP) in Windows, which is associated with insufficient protection of service data. This allows a remote attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Point-to-Point Tunneling Protocol (affected versions not specified) **Description** The issue is related to the implementation of the Point to Point Tunneling Protocol (PPTP) in Windows operating systems, specifically concerning errors in synchronization when using a shared resource, known as a "race condition". This can be exploited by a remote attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Point-to-Point Tunneling Protocol versions (affected versions not specified) **Description** The issue is related to the implementation of the Point-to-Point Tunneling Protocol (PPTP) in Windows operating systems, specifically concerning synchronization errors when using a shared resource, known as a "race condition". This can allow a remote attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to the implementation of the Point-to-Point Tunneling Protocol (PPTP) in Windows operating systems, which is associated with insufficient input validation. This can be exploited by a remote attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache httpd versions 2.0.23 through 2.0.65 Apache httpd versions 2.2.0 through 2.2.34 Apache httpd versions 2.4.0 through 2.4.29 **Description** The issue is related to the mod authnz ldap component in Apache httpd, specifically when configured with AuthLDAPCharsetConfig. It uses the Accept-Language header value to determine the correct charset encoding for user credential verification. If the header value is not found in the charset conversion table, it is truncated to a two-character value. A header value with less than two characters can cause an out-of-bounds write of a NUL byte to a memory location, potentially leading to a Denial of Service attack, although this is unlikely. In most cases, the memory is already reserved for future use, and the issue has no effect. **Recommendations** For Apache httpd versions 2.0.23 through 2.0.65, consider disabling the AuthLDAPCharsetConfig to prevent the issue until a patch is available. For Apache httpd versions 2.2.0 through 2.2.34, consider disabling the AuthLDAPCharsetConfig to prevent the issue until a patch is available. For Apache httpd versions 2.4.0 through 2.4.29, consider disabling the AuthLDAPCharsetConfig to prevent the issue until a patch is available. As a temporary workaround, consider restricting access to the `Accept-Language` header to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** libcurl versions prior to 7.57.0 **Description** The issue is related to the NTLM authentication feature in libcurl, which allows attackers to cause a denial of service or possibly have other impacts via vectors involving long user and password fields. This is due to a buffer overrun flaw in the NTLM authentication code. The internal function `Curl ntlm core mk ntlmv2 hash` calculates the storage size by summing the lengths of the `username` and `password` and multiplying by two. On 32-bit systems, this calculation can trigger an integer overflow when the combined lengths exceed 2GB, resulting in a very small buffer being allocated instead of the intended large one, leading to a buffer overrun. **Recommendations** For versions prior to 7.57.0, update to version 7.57.0 or later to resolve the issue. As a temporary workaround, consider restricting the length of the `username` and `password` fields to prevent the integer overflow and buffer overrun.

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions 2.4.54 and earlier Description: A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. The issue is also related to a buffer overflow in the mod dav module, which can allow a remote attacker to cause a denial of service. Recommendations: For Apache HTTP Server versions 2.4.54 and earlier, update to a version later than 2.4.54 to resolve the issue. As a temporary workaround, consider restricting access to the If: request header to minimize the risk of exploitation. Additionally, restricting access to the mod dav module can also help mitigate the risk of a denial of service attack.