Description (CNA)
The code in pppd that formats a response to a PEAP Request packet in peap_response() copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacket_buf without checking the available space and without implementing outgoing PEAP fragmentation. Thus a pppd process connecting to a server which requests PEAP authentication can be induced to corrupt global static data following the outpacket_buf array, most likely causing incorrect behavior or a crash.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| PPP Project / ppp | affected 0 through 2.5.0; unaffected 2.5.4 |
CWE
CWE-122
References
ADP enrichment
No English description supplied.
No references supplied.