PT-2014-1917 · Ppp+2 · Ppp+2

Lee Campbell · Published 2014-09-03 · Updated 2024-06-15 · CVE-2014-3158

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ppp versions prior to 2.4.7

Description The issue is related to an integer overflow in the getword function in options.c in pppd, which can trigger a heap-based buffer overflow. This overflow can corrupt security-relevant variables, potentially allowing attackers to access privileged options. The vulnerability can be exploited remotely and may lead to a violation of confidentiality, integrity, and availability of protected information.

Recommendations For versions prior to 2.4.7, update to version 2.4.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the options file to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-09784

CVE-2014-3158

DLA-74-1

DSA-3079-1

MGASA-2014-0368

OPENSUSE-SU-2024:10049-1

SUSE-SU-2014_1088-1

USN-2429-1

Affected Products

Suse

Ubuntu

Ppp

References · 27

• http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136932.html · Vendor Advisory
• http://debian.org/security/2014/dsa-3079 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-3158 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3158 · Security Note
• https://ubuntu.com/security/notices/USN-2429-1 · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2014-August/136932.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3158 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3158 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-3158 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-3158 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0368 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2429-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0368.html · Security Note
• http://ubuntu.com/usn/USN-2429-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2015:135 · Vendor Advisory