正文

ppp < 2.4.8 缓冲区溢出代码执行漏洞

admin
admin V管理员 /0 评论 /36 阅读
0410
此篇文章发布距今已超过1124天，您需要注意文章的内容或图片是否可用！

CVE编号

CVE-2020-8597

利用情况

EXP 已公开

补丁情况

官方补丁

披露时间

2020-02-04
漏洞描述
ppp 2.4.2到2.4.8中的pppd中的eap.c在eap_request和eap_response函数中有一个rhostname缓冲区溢出。
解决建议
厂商已发布了漏洞修复程序，请及时关注更新：
https://github.com/paulusmack/ppp/commit/8d7970b8f3db727fe798b65f3377fe6787575426
参考链接
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00006.html
http://packetstormsecurity.com/files/156662/pppd-2.4.8-Buffer-Overflow.html
http://packetstormsecurity.com/files/156802/pppd-2.4.8-Buffer-Overflow.html
http://seclists.org/fulldisclosure/2020/Mar/6
https://access.redhat.com/errata/RHSA-2020:0630
https://access.redhat.com/errata/RHSA-2020:0631
https://access.redhat.com/errata/RHSA-2020:0633
https://access.redhat.com/errata/RHSA-2020:0634
https://cert-portal.siemens.com/productcert/pdf/ssa-809841.pdf
https://github.com/paulusmack/ppp/commit/8d7970b8f3db727fe798b65f3377fe6787575426
https://kb.netgear.com/000061806/Security-Advisory-for-Unauthenticated-Remote...
https://lists.debian.org/debian-lts-announce/2020/02/msg00005.html
https://lists.fedoraproject.org/archives/list/[email protected]...
https://lists.fedoraproject.org/archives/list/[email protected]...
https://security.gentoo.org/glsa/202003-19
https://security.netapp.com/advisory/ntap-20200313-0004/
https://us-cert.cisa.gov/ics/advisories/icsa-20-224-04
https://usn.ubuntu.com/4288-1/
https://usn.ubuntu.com/4288-2/
https://www.debian.org/security/2020/dsa-4632
https://www.kb.cert.org/vuls/id/782301
https://www.synology.com/security/advisory/Synology_SA_20_02
受影响软件情况
# 类型 厂商 产品 版本 影响面
1
运行在以下环境
应用 point-to-point_protocol_project point-to-point_protocol * From
(including)
2.4.2 		Up to
(including)
2.4.8
运行在以下环境
系统 alibaba_cloud_linux_2.1903 ppp * Up to
(excluding)
2.4.5-34.1.al7
运行在以下环境
系统 alpine_3.10 ppp * Up to
(excluding)
2.4.7-r7
运行在以下环境
系统 alpine_3.11 ppp * Up to
(excluding)
2.4.7-r7
运行在以下环境
系统 alpine_3.12 ppp * Up to
(excluding)
2.4.8-r1
运行在以下环境
系统 alpine_3.13 ppp * Up to
(excluding)
2.4.8-r1
运行在以下环境
系统 alpine_3.14 ppp * Up to
(excluding)
2.4.8-r1
运行在以下环境
系统 alpine_3.15 ppp * Up to
(excluding)
2.4.8-r1
运行在以下环境
系统 alpine_3.8 ppp * Up to
(excluding)
2.4.7-r7
运行在以下环境
系统 alpine_3.9 ppp * Up to
(excluding)
2.4.7-r7
运行在以下环境
系统 alpine_edge ppp * Up to
(excluding)
2.4.8-r1
运行在以下环境
系统 amazon_2 ppp * Up to
(excluding)
2.4.5-33.amzn2.0.3
运行在以下环境
系统 amazon_AMI ppp * Up to
(excluding)
2.4.5-11.9.amzn1
运行在以下环境
系统 centos_6 ppp * Up to
(excluding)
2.4.5-11.el6_10
运行在以下环境
系统 centos_7 ppp * Up to
(excluding)
2.4.5-34.el7_7
运行在以下环境
系统 centos_8 ppp * Up to
(excluding)
2.4.7-26.el8_1
运行在以下环境
系统 debian_10 ppp * Up to
(excluding)
2.0.3-3+deb10u1
运行在以下环境
系统 debian_11 ppp * Up to
(excluding)
2.4.7-2+4.1+deb10u1
运行在以下环境
系统 debian_8 ppp * Up to
(excluding)
2.4.6-3.1+deb8u1
运行在以下环境
系统 debian_9 ppp * Up to
(excluding)
2.4.7-1+4+deb9u1
运行在以下环境
系统 debian_sid ppp * Up to
(excluding)
2.4.7-2+4.1+deb10u1
运行在以下环境
系统 fedora_30 ppp * Up to
(excluding)
2.4.7-34.fc30
运行在以下环境
系统 fedora_31 ppp * Up to
(excluding)
2.4.7-34.fc31
运行在以下环境
系统 opensuse_Leap_15.1 ppp * Up to
(excluding)
2.4.7-lp151.5.3.1
运行在以下环境
系统 oracle_6 ppp * Up to
(excluding)
2.4.5-11.el6_10
运行在以下环境
系统 oracle_7 ppp * Up to
(excluding)
2.4.5-34.el7_7
运行在以下环境
系统 oracle_8 ppp * Up to
(excluding)
2.4.7-26.el8_1
运行在以下环境
系统 redhat_8 ppp * Up to
(excluding)
2.4.7-26.el8_1
运行在以下环境
系统 suse_12_SP4 ppp * Up to
(excluding)
2.4.7-4.3.1
运行在以下环境
系统 suse_12_SP5 ppp * Up to
(excluding)
2.4.7-4.3.1
运行在以下环境
系统 ubuntu_14.04 ppp * Up to
(excluding)
2.4.5-5.1ubuntu2.3+esm1
运行在以下环境
系统 ubuntu_16.04 ppp * Up to
(excluding)
2.4.7-1+2ubuntu1.16.04.2
运行在以下环境
系统 ubuntu_18.04 ppp * Up to
(excluding)
2.4.7-2+2ubuntu1.2
运行在以下环境
系统 ubuntu_20.04 ppp * Up to
(excluding)
2.4.7-2+4.1ubuntu5
运行在以下环境
系统 ubuntu_21.04 ppp * Up to
(excluding)
2.4.7-2+4.1ubuntu5
阿里云评分 9.0
  • 攻击路径 远程
  • 攻击复杂度 复杂
  • 权限要求 无需权限
  • 影响范围 全局影响
  • EXP成熟度 EXP 已公开
  • 补丁情况 官方补丁
  • 数据保密性 数据泄露
  • 数据完整性 传输被破坏
  • 服务器危害 服务器失陷
  • 全网数量 1000
CWE-ID 漏洞类型 CWE-120 未进行输入大小检查的缓冲区拷贝（传统缓冲区溢出）