PT-2021-11456 · Accel-Ppp+1 · Accel-Ppp+1

Leommxj + 1 · Published 2021-02-01 · Updated 2024-04-01 · CVE-2020-28194

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: accel-ppp (affected versions not specified)

Description: A variable underflow exists in the radius/packet.c file of accel-ppp when receiving a RADIUS vendor-specific attribute with a length field less than 2. This issue can lead to arbitrary code execution, but only when the attacker controls the RADIUS server.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

ALT-PU-2024-4819

CVE-2020-28194

GHSA-2M44-RH3C-X4GR

Affected Products

Alt Linux

Accel-Ppp

References · 7

• https://github.com/accel-ppp/accel-ppp/commit/e9d369aa0054312b7633e964e9f7eb323f1f3d69 · Patch
• https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-2m44-rh3c-x4gr · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-28194 · Security Note
• https://osv.dev/vulnerability/CVE-2020-28194 · Vendor Advisory
• https://t.me/cibsecurity/22883 · Telegram Post
• https://t.me/cvenotify/9511 · Telegram Post
• https://t.me/cvenotify/9244 · Telegram Post