pppd (Point to Point Protocol Daemon) versions 2.4.2 through 2.4.8 are vulnerable to buffer overflow due to a flaw in Extensible Authentication Protocol (EAP) packet processing in eap_request and eap_response subroutines.
PPP is the protocol used for establishing internet links over dial-up modems, DSL connections, and many other types of point-to-point links including Virtual Private Networks (VPN) such as Point to Point Tunneling Protocol (PPTP). The pppd software can also authenticate a network connected peer and/or supply authentication information to the peer using multiple authentication protocols including EAP.
Due to a flaw in the Extensible Authentication Protocol (EAP) packet processing in the Point-to-Point Protocol Daemon (pppd), an unauthenticated remote attacker may be able to cause a stack buffer overflow, which may allow arbitrary code execution on the target system. This vulnerability is due to an error in validating the size of the input before copying the supplied data into memory. As the validation of the data size is incorrect, arbitrary data can be copied into memory and cause memory corruption possibly leading to execution of unwanted code.
The vulnerability is in the logic of the eap parsing code, specifically in the eap_request() and eap_response() functions in eap.c that are called by a network input handler. These functions take a pointer and length as input using the the first byte as a type. If the type is EAPT_MD5CHAP(4), it looks at an embedded 1-byte length field. The logic in this code is intended to makes sure that embedded length is smaller than the whole packet length. After this verification, it tries to copy provided data (hostname) that is located after the embedded length field into a local stack buffer. This bounds check is incorrect and allows for memory copy to happen with an arbitrary length of data.
An additional logic flaw causes the eap_input() function to not check if EAP has been negotiated during the Link Control Protocol (LCP) phase. This allows an unauthenticated attacker to send an EAP packet even if ppp refused the authentication negotiation due to lack of support for EAP or due to mismatch of an agreed pre-shared passphrase in the LCP phase. The vulnerable pppd code in eap_input will still process the EAP packet and trigger the stack buffer overflow. This unverified data with an unknown size can be used to corrupt memory of the target system. The pppd often runs with high privileges (system or root) and works in conjunction with kernel drivers. This makes it possible for an attacker to potentially execute arbitrary code with system or root level privileges.
The pppd software is also adopted into lwIP (lightweight IP) project to provide pppd capabilities for small devices. The default installer and packages of lwIP are not vulnerable to this buffer overflow. However if you have used the lwIP source code and configured specifically to enable EAP at compile time, your software is likely vulnerable to the buffer overflow. The recommended update is available from Git repoistory http://git.savannah.nongnu.org/cgit/lwip.git.
This type of weakness is commonly associated in Common Weakness Enumeration (CWE) with CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'). A Proof-of-Concept exploit for PPTP VPN Servers with additional tools are available in the by CERT/CC PoC repository.
By sending an unsolicited EAP packet to a vulnerable ppp client or server, an unauthenticated remote attacker could cause memory corruption in the pppd process, which may allow for arbitrary code execution.
Update your software with the latest available patches provided by your software vendor. It is incorrect to assume that pppd is not vulnerable if EAP is not enabled or EAP has not been negotiated by a remote peer using a secret or passphrase. This is due to the fact that an authenticated attacker may still be able to send unsolicited EAP packet to trigger the buffer overflow.
If your software is packaged and created from the ppp source code, please obtain the latest software from github pppd repository.
Patch referenced :
In case of lwIP package that is compiled from source with EAP enabled at compile time, obtain the latest software from github
Note: the latest software also includes ignoring out-of-order or unsolicited EAP packets from being processed as an additional precautionary measure. It is recommended that you use the latest available software from the appropriate Git repository that includes this fix.
Proof of Concept (PoC)
A proof-of-concept for testing if a PPTP server is vulnerable to cve-2020-8597 is available in the CERT/CC PoC respository
Detection Signature (IDS)
A Snort/Surricata IDS rule to detect cve-2020-8597 buffer overflow attempts against PPTP servers is also available in the CERT/CC PoC respository.
There is no viable work around except to patch the software with updated software made available by the software vendors.
Thanks to Ilja Van Sprundel from IOActive for reporting this vulnerability.
This document was written by Vijay Sarvepalli.
Arch Linux Affected
Check Point Affected
Debian GNU/Linux Affected
Fedora Project Affected
Red Hat Inc. Affected
SUSE Linux Affected
Sierra Wireless Affected
Slackware Linux Inc. Affected
Ubiquiti Networks Affected
Wind River Affected
AVM GmbH Not Affected
Actiontec Not Affected
Apple Not Affected
Arista Networks Inc. Not Affected
Brocade Communication Systems Not Affected
CoreOS Not Affected
DrayTek Corporation Not Affected
Fortinet Not Affected
FreeBSD Project Not Affected
HardenedBSD Not Affected
Juniper Networks Not Affected
LANCOM Systems GmbH Not Affected
MikroTik Not Affected
OpenBSD Not Affected
lwIP Not Affected
A10 Networks Unknown
ASUSTeK Computer Inc. Unknown
Alcatel-Lucent Enterprise Unknown
Alpine Linux Unknown
Aspera Inc. Unknown
Avaya Inc. Unknown
Belkin Inc. Unknown
Buffalo Technology Unknown
D-Link Systems Inc. Unknown
Dell EMC Unknown
Deutsche Telekom Unknown
DragonFly BSD Project Unknown
Extreme Networks Unknown
F-Secure Corporation Unknown
F5 Networks Inc. Unknown
Gentoo Linux Unknown
HP Inc. Unknown
Hewlett Packard Enterprise Unknown
Huawei Technologies Unknown
IBM Corporation Unknown
Marconi Inc. Unknown
Micro Focus Unknown
Mitel Networks Inc. Unknown
Motorola Inc. Unknown
NEC Corporation Unknown
Netgear Inc. Unknown
Openwall GNU/*/Linux Unknown
Oracle Corporation Unknown
QNX Software Systems Inc. Unknown
Quantenna Communications Unknown
Ruckus Wireless Unknown
SMC Networks Inc. Unknown
TDS Telecom Unknown
Unisys Corporation Unknown
|Date First Published:||2020-03-04|
|Date Last Updated:||2020-06-15 13:40 UTC|