PT-2008-2808 · Netbsd · Ppp

Published 2008-03-09 · Updated 2017-08-08 · CVE-2008-1215

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ppp versions in FreeBSD 6.3 and 7.0 ppp versions in OpenBSD 4.1 and 4.2 ppp in the net/userppp package for NetBSD

Description A stack-based buffer overflow issue exists in the command Expand Interpret function, allowing local users to gain privileges via long commands containing "~" characters.

Recommendations For ppp in FreeBSD 6.3 and 7.0, consider restricting access to the command Expand Interpret function until a patch is available. For ppp in OpenBSD 4.1 and 4.2, avoid using long commands containing "~" characters in the affected function. For ppp in the net/userppp package for NetBSD, restrict the use of the vulnerable command Expand Interpret function to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-1215

Affected Products

Ppp

References · 11

• 🔥 http://securityfocus.com/archive/82/489031/30/0/threaded · Exploit
• 🔥 http://securityfocus.com/bid/28090 · Exploit
• 🔥 https://exploit-db.com/exploits/31333 · Exploit
• 🔥 http://securityfocus.com/archive/82/488980/30/0/threaded · Exploit
• http://secunia.com/advisories/29234 · Vendor Advisory
• http://secunia.com/advisories/29240 · Vendor Advisory
• http://openbsd.org/errata41.html#014_ppp · Vendor Advisory
• http://openbsd.org/errata42.html#009_ppp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1215 · Security Note
• http://secunia.com/advisories/29238 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41034 · Note