Affected: AlmaLinux:8: ppp, AlmaLinux:8: ppp-devel

The ppp packages contain the Point-to-Point Protocol (PPP) daemon and documentation for PPP support. The PPP protocol provides a method for transmitting datagrams over serial point-to-point links. PPP is usually used to dial in to an Internet Service Provider (ISP) or other organization over a modem and phone line.

Security Fix(es):

* ppp: Buffer overflow in the eap_request and eap_response functions in eap.c (CVE-2020-8597)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Withdrawn by the publisher.

eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.

eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.

The version of pppd shipped with this product has a vulnerability that may allow an unauthenticated remote attacker to cause a stack buffer overflow, which may allow arbitrary code execution on the target system.

Security update for ppp

ppp: Buffer overflow in the eap_request and eap_response functions in eap.c

Schneider Electric is aware of a vulnerability in the Easergy T300 RTU (Remote Terminal Unit). The Easergy T300 is a modular platform for medium voltage and low voltage public distribution network management. Failure to apply the mitigations provided below may allow for arbitrary code execution, which could result in denial of service.

Security update for ppp

Affected: Ubuntu:Pro:14.04:LTS: ppp, Ubuntu:16.04:LTS: ppp, Ubuntu:18.04:LTS: ppp, Ubuntu:20.04:LTS: ppp, Ubuntu:Pro:20.04:LTS: lwip

eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.

FL MGUARD, TC MGUARD, TC ROUTER and TC CLOUD CLIENT devices are affected by a buffer overflow vulnerability within the PPP service.

The PPP service is not active by default, but is used commonly at TC ROUTER, TC CLOUD CLIENT. It is also running in the following FL MGUARD and TC MGUARD configurations:

• Mobile data connection • Router mode "Modem" • Router mode "PPPoE" • L2TP over IPsec

Malicious PPP peers could try to exploit the vulnerability from remote.

WAGO PLCs uses Linux as operating system and offers the ambitious user the opportunity to make their own modifications to expand the functionality of the PLC. For this reason the pppd daemon is also part of the operating system but it is not activated in the default configuration of the WAGO firmware.

The reported vulnerability is only exploitable if the customer has activated the pppd daemon in his individual configuration manually. If the pppd daemon is used by the application from the customer, an unauthenticated remote attacker could cause a memory corruption in the pppd process, which may allow for arbitrary code execution, by sending an unsolicited EAP packet.