PT-2022-13571 · Accel-Ppp+1 · Accel-Ppp+1

Chloe Ong + 2 · Published 2022-03-16 · Updated 2024-04-01 · CVE-2022-0982

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions accel-pppd (affected versions not specified)

Description The issue is related to a memory corruption vulnerability in the telnet input char function. This vulnerability occurs because user input cmdline len is copied into a fixed buffer b->buf without any bound checks. As a result, if the server connects with a malicious client, crafted client requests can remotely trigger this vulnerability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2024-4819

CVE-2022-0982

Affected Products

Alt Linux

Accel-Ppp

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-0982 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0982 · Vendor Advisory
• https://github.com/xebd/accel-ppp/issues/164 · Note
• https://t.me/cibsecurity/39082 · Telegram Post