PT-2018-10677 · Paul Mackerras+1 · Pppd+1

Ivan Gotovchits · Published 2018-06-14 · Updated 2025-12-03 · CVE-2018-11574

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PPPD versions prior to the version with the fixed patch

Description The issue arises from improper input validation combined with an integer overflow in the EAP-TLS protocol implementation. This can lead to a crash, information disclosure, or authentication bypass. The affected implementation includes the eap.c and eap-tls.c files and is distributed as a patch for PPPD 0.91. Configurations using the refuse-app option are not affected.

Recommendations For PPPD versions prior to the version with the fixed patch, consider disabling the EAP-TLS protocol until a patch is available. Restrict access to the affected eap.c and eap-tls.c files to minimize the risk of exploitation. Avoid using configurations that do not include the refuse-app option in the affected PPPD versions until the issue is resolved.

Fix

RCE

Integer Overflow

Weakness Enumeration

CWE-20

CWE-190

Related Identifiers

CVE-2018-11574

USN-3810-1

Affected Products

Pppd

Ubuntu

References · 14

• https://osv.dev/vulnerability/CVE-2018-11574 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-11574 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-11574 · Vendor Advisory
• http://openwall.com/lists/oss-security/2018/06/11/1 · Patch
• https://usn.ubuntu.com/3810-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3810-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3810-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11574 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-11574 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-11574 · Security Note
• https://ubuntu.com/security/CVE-2018-11574 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-11574 · Vendor Advisory
• https://t.me/cveNotify/144661 · Telegram Post
• https://nikhef.nl/~janjust/ppp/ppp-2.4.7-eaptls-mppe-1.101.patch · Note