A vulnerability classified as problematic has been found in ppp (the affected version unknown). Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf with an unknown input leads to a array index vulnerability. CWE is classifying the issue as CWE-129. The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was presented 12/18/2022 as a75fb7b198eed50d769c80c36629f38346882cbf. The advisory is available at github.com. This vulnerability is traded as CVE-2022-4603. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

The real existence of this vulnerability is still doubted at the moment. pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.

Applying the patch a75fb7b198eed50d769c80c36629f38346882cbf is able to eliminate this problem. The bugfix is ready for download at github.com.

See VDB-2358, VDB-45325, VDB-67449 and VDB-149645 for similar entries.

Productinfo

Name

• ppp

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion