CVE-2004-1002: Integer Underflow
Published Nov 4, 2004
·Updated
Integer underflow in pppd in cbcp.c for ppp 2.4.1 allows remote attackers to cause a denial of service (daemon crash) via a CBCP packet with an invalid length value that causes pppd to access an incorrect memory location.
Affected Software
3 affected components
Point-to-point Protocol Project Point-to-point Protocol=2.4.1
Samba Ppp=2.4.1
Canonical Ubuntu Linux=4.10
Event History
Nov 4, 2004
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-1002?
CVE-2004-1002 has a moderate severity rating as it allows remote denial of service by causing a crash.
2
How do I fix CVE-2004-1002?
To fix CVE-2004-1002, update the Point-to-Point Protocol (PPP) to a version newer than 2.4.1.
3
Which software is affected by CVE-2004-1002?
CVE-2004-1002 affects Point-to-Point Protocol version 2.4.1, Samba PPP 2.4.1, and Ubuntu Linux 4.10.
4
What is the exploit method for CVE-2004-1002?
CVE-2004-1002 can be exploited by sending a CBCP packet with an invalid length value to the pppd service.
5
Is there a workaround for CVE-2004-1002?
A temporary workaround for CVE-2004-1002 involves disabling CBCP or restricting access to the pppd service.