{
    "file_item": {
        "filepath": "security-advisories",
        "filename": "CERT-EU-SA2020-013.pdf"
    },
    "title": "Critical PPP Daemon Vulnerability",
    "serial_number": "2020-013",
    "publish_date": "06-03-2020 19:42:00",
    "description": "A new dangerous (and 17 years old!) remote code execution vulnerability has been discovered by Ilja Van Sprundel from IOActive. It affects the PPP daemon (\"pppd\") software that comes installed on almost all Linux-based operating systems and powers the firmware of many other networking devices. The affected \"pppd\" software is an implementation of Point-to-Point Protocol (PPP) that enables communication and data transfer between nodes, primarily used to establish Internet links such as those over dial-up modems, DSL broadband connections, and Virtual Private Networks.<br>The vulnerability is tracked as CVE-2020-8597 with \"CVSS Score 9.8\" and can be exploited by unauthenticated attackers to remotely execute arbitrary code on affected systems and take full control over them.",
    "url_title": "2020-013",
    "content_markdown": "---\ntitle: 'Critical PPP Daemon Vulnerability'\nversion: '1.0'\nnumber: '2020-013'\ndate: 'March 06, 2020'\n---\n\n_History:_\n\n* _06/03/2020 --- v1.0 -- Initial publication_\n\n# Summary\n\nA new dangerous (and 17 years old!) remote code execution vulnerability has been discovered by Ilja Van Sprundel from IOActive [1, 2, 3]. It affects the PPP daemon (`pppd`) software that comes installed on almost all Linux-based operating systems and powers the firmware of many other networking devices. The affected `pppd` software is an implementation of Point-to-Point Protocol (PPP) that enables communication and data transfer between nodes, primarily used to establish Internet links such as those over dial-up modems, DSL broadband connections, and Virtual Private Networks.\n\nThe vulnerability is tracked as CVE-2020-8597 with **CVSS Score 9.8** and can be exploited by unauthenticated attackers to remotely execute arbitrary code on affected systems and take full control over them.\n\n# Technical Details\n\nThe critical issue is a _stack buffer overflow_ vulnerability that exists due to a logical error in the Extensible Authentication Protocol (EAP) packet parser of the `pppd` software, an extension that provides support for additional authentication methods in PPP connections.\n\nFor this, all an attacker needs to do is to send an unsolicited malformed EAP packet to a vulnerable ppp client or a server over a direct serial link, ISDN, Ethernet, SSH, socket CAT, PPTP, GPRS, or ATM networks.\n\nAdditionally, since `pppd` often runs with high privileges and works in conjunction with kernel drivers, the flaw could allow attackers to potentially execute malicious code with the system or root-level privileges.\n\nThis vulnerability is due to an error in validating the size of the input before copying the supplied data into memory. As the validation of the data size is incorrect, arbitrary data can be copied into memory and cause memory corruption, possibly leading to the execution of unwanted code.\n\nThe vulnerability is in the logic of the EAP parsing code, specifically in the `eap_request()` and `eap_response()` functions in `eap.c` that are called by a network input handler.\n\n# Products Affected\n\n`pppd` versions 2.4.2 through 2.4.8 \u2014- i.e, all versions released in the last 17 years -\u2014 are vulnerable to this new remote code execution vulnerability [1].\n\nSome of the widely-used, popular Linux and BSD distributions listed below have already been confirmed impacted, and many other projects are most likely affected as well:\n\n- Debian\n- Ubuntu\n- SUSE Linux\n- Fedora\n- NetBSD\n- Red Hat Enterprise Linux\n\nBesides this, the list of other vulnerable applications and devices (some of them listed below) that ship the `pppd` software is also likely extensive, opening a large attack surface for hackers. Examples include [2]:\n\n- Cisco CallManager\n- TP-LINK products\n- OpenWRT Embedded OS\n- Synology products\n\n# Recommendations\n\nUsers with affected operating systems and devices are advised to apply security patches as soon as possible, or when they becomes available. Some statements regarding available or planned patches are available in [1]. The updated, non-vulnerable source code is already available in Github [4].\n\nAt the time of writing, we are not aware of any public proof-of-concept exploit code for this vulnerability or any in-the-wild exploitation attempts.\n\n# References\n\n[1] <https://www.kb.cert.org/vuls/id/782301/>\n\n[2] <https://thehackernews.com/2020/03/ppp-daemon-vulnerability.html>\n\n[3] <https://sensorstechforum.com/cve-2020-8597-ppp-daemon-flaw-linux/>\n\n[4] <https://github.com/paulusmack/ppp>\n",
    "content_html": "<p><em>History:</em></p><ul><li><em>06/03/2020 --- v1.0 -- Initial publication</em></li></ul><h2 id=\"summary\">Summary</h2><p>A new dangerous (and 17 years old!) remote code execution vulnerability has been discovered by Ilja Van Sprundel from IOActive [1, 2, 3]. It affects the PPP daemon (<code>pppd</code>) software that comes installed on almost all Linux-based operating systems and powers the firmware of many other networking devices. The affected <code>pppd</code> software is an implementation of Point-to-Point Protocol (PPP) that enables communication and data transfer between nodes, primarily used to establish Internet links such as those over dial-up modems, DSL broadband connections, and Virtual Private Networks.</p><p>The vulnerability is tracked as CVE-2020-8597 with <strong>CVSS Score 9.8</strong> and can be exploited by unauthenticated attackers to remotely execute arbitrary code on affected systems and take full control over them.</p><h2 id=\"technical-details\">Technical Details</h2><p>The critical issue is a <em>stack buffer overflow</em> vulnerability that exists due to a logical error in the Extensible Authentication Protocol (EAP) packet parser of the <code>pppd</code> software, an extension that provides support for additional authentication methods in PPP connections.</p><p>For this, all an attacker needs to do is to send an unsolicited malformed EAP packet to a vulnerable ppp client or a server over a direct serial link, ISDN, Ethernet, SSH, socket CAT, PPTP, GPRS, or ATM networks.</p><p>Additionally, since <code>pppd</code> often runs with high privileges and works in conjunction with kernel drivers, the flaw could allow attackers to potentially execute malicious code with the system or root-level privileges.</p><p>This vulnerability is due to an error in validating the size of the input before copying the supplied data into memory. As the validation of the data size is incorrect, arbitrary data can be copied into memory and cause memory corruption, possibly leading to the execution of unwanted code.</p><p>The vulnerability is in the logic of the EAP parsing code, specifically in the <code>eap_request()</code> and <code>eap_response()</code> functions in <code>eap.c</code> that are called by a network input handler.</p><h2 id=\"products-affected\">Products Affected</h2><p><code>pppd</code> versions 2.4.2 through 2.4.8 \u2014- i.e, all versions released in the last 17 years -\u2014 are vulnerable to this new remote code execution vulnerability [1].</p><p>Some of the widely-used, popular Linux and BSD distributions listed below have already been confirmed impacted, and many other projects are most likely affected as well:</p><ul><li>Debian</li><li>Ubuntu</li><li>SUSE Linux</li><li>Fedora</li><li>NetBSD</li><li>Red Hat Enterprise Linux</li></ul><p>Besides this, the list of other vulnerable applications and devices (some of them listed below) that ship the <code>pppd</code> software is also likely extensive, opening a large attack surface for hackers. Examples include [2]:</p><ul><li>Cisco CallManager</li><li>TP-LINK products</li><li>OpenWRT Embedded OS</li><li>Synology products</li></ul><h2 id=\"recommendations\">Recommendations</h2><p>Users with affected operating systems and devices are advised to apply security patches as soon as possible, or when they becomes available. Some statements regarding available or planned patches are available in [1]. The updated, non-vulnerable source code is already available in Github [4].</p><p>At the time of writing, we are not aware of any public proof-of-concept exploit code for this vulnerability or any in-the-wild exploitation attempts.</p><h2 id=\"references\">References</h2><p>[1] <a rel=\"noopener\" target=\"_blank\" href=\"https://www.kb.cert.org/vuls/id/782301/\">https://www.kb.cert.org/vuls/id/782301/</a></p><p>[2] <a rel=\"noopener\" target=\"_blank\" href=\"https://thehackernews.com/2020/03/ppp-daemon-vulnerability.html\">https://thehackernews.com/2020/03/ppp-daemon-vulnerability.html</a></p><p>[3] <a rel=\"noopener\" target=\"_blank\" href=\"https://sensorstechforum.com/cve-2020-8597-ppp-daemon-flaw-linux/\">https://sensorstechforum.com/cve-2020-8597-ppp-daemon-flaw-linux/</a></p><p>[4] <a rel=\"noopener\" target=\"_blank\" href=\"https://github.com/paulusmack/ppp\">https://github.com/paulusmack/ppp</a></p>",
    "licence": {
        "title": "Creative Commons Attribution 4.0 International (CC-BY 4.0)",
        "link": "https://creativecommons.org/licenses/by/4.0/",
        "restrictions": "https://cert.europa.eu/legal-notice",
        "author": "The Cybersecurity Service for the Union institutions, bodies, offices and agencies"
    }
}