Most recent entries from all

ALSA-2020:0633 — Important: ppp security update

Affected: AlmaLinux:8: ppp, AlmaLinux:8: ppp-devel

The ppp packages contain the Point-to-Point Protocol (PPP) daemon and documentation for PPP support. The PPP protocol provides a method for transmitting datagrams over serial point-to-point links. PPP is usually used to dial in to an Internet Service Provider (ISP) or other organization over a modem and phone line.

Security Fix(es):

* ppp: Buffer overflow in the eap_request and eap_response functions in eap.c (CVE-2020-8597)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2020-01026

Withdrawn: BELL-CVE-2020-8597 — CVE-2020-8597 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2020-avi-325 — Une vulnérabilité a été découverte dans Hirschmann OWL. Elle permet à un attaquant de provoquer une exécution de code a…

certfr-2020-avi-325

cnvd-2020-09603

EUVD-2026-262405

fkie_cve-2020-8597

eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.

GHSA-gw8r-xfqw-vw42

eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.

gsd-2020-8597

ICSA-20-224-04 — Siemens SCALANCE, RUGGEDCOM

The version of pppd shipped with this product has a vulnerability that may allow an unauthenticated remote attacker to cause a stack buffer overflow, which may allow arbitrary code execution on the target system.

msrc_CVE-2020-8597 — eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.

msrc_CVE-2020-8597

openSUSE-SU-2020:0286-1 — Security update for ppp

Security update for ppp

RHSA-2020:0631 — Red Hat Security Advisory: ppp security update

ppp: Buffer overflow in the eap_request and eap_response functions in eap.c

SEVD-2022-011-02 — Easergy T300

Schneider Electric is aware of a vulnerability in the Easergy T300 RTU (Remote Terminal Unit). The Easergy T300 is a modular platform for medium voltage and low voltage public distribution network management. Failure to apply the mitigations provided below may allow for arbitrary code execution, which could result in denial of service.

SUSE-SU-2020:0489-1 — Security update for ppp

Security update for ppp

UBUNTU-CVE-2020-8597

Affected: Ubuntu:Pro:14.04:LTS: ppp, Ubuntu:16.04:LTS: ppp, Ubuntu:18.04:LTS: ppp, Ubuntu:20.04:LTS: ppp, Ubuntu:Pro:20.04:LTS: lwip

eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.

VDE-2020-018 — PHOENIX CONTACT: FL MGUARD, TC MGUARD, TC ROUTER and TC CLOUD CLIENT: PPPD vulnerable to CVE-2020-8597

FL MGUARD, TC MGUARD, TC ROUTER and TC CLOUD CLIENT devices are affected by a buffer overflow vulnerability within the PPP service.

The PPP service is not active by default, but is used commonly at TC ROUTER, TC CLOUD CLIENT. It is also running in the following FL MGUARD and TC MGUARD configurations:

• Mobile data connection • Router mode "Modem" • Router mode "PPPoE" • L2TP over IPsec

Malicious PPP peers could try to exploit the vulnerability from remote.

VDE-2020-020 — WAGO: PPPD in PFC100 and PFC200 Series is vulnerable to CVE-2020-8597

WAGO PLCs uses Linux as operating system and offers the ambitious user the opportunity to make their own modifications to expand the functionality of the PLC. For this reason the pppd daemon is also part of the operating system but it is not activated in the default configuration of the WAGO firmware.

The reported vulnerability is only exploitable if the customer has activated the pppd daemon in his individual configuration manually. If the pppd daemon is used by the application from the customer, an unauthenticated remote attacker could cause a memory corruption in the pppd process, which may allow for arbitrary code execution, by sending an unsolicited EAP packet.