CVE-2015-3310

NameCVE-2015-3310
DescriptionBuffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial of service (crash) via a start accounting message to the RADIUS server.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-205-1, DSA-3228-1
Debian Bugs782450

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ppp (PTS)bullseye2.4.9-1+1fixed
bookworm2.4.9-1+1.1fixed
sid, trixie2.5.1-1+1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
pppsourcesqueeze2.4.5-4+deb6u2DLA-205-1
pppsourcewheezy2.4.5-5.1+deb7u2DSA-3228-1
pppsource(unstable)2.4.6-3.1782450

Notes

https://www.openwall.com/lists/oss-security/2015/04/13/4
Patch: https://bugs.debian.org/cgi-bin/bugreport.cgi?msg=17;filename=ppp_2.4.6-3.1-nmu.diff;att=1;bug=782450

Search for package or bug name: Reporting problems