CVE-2014-3158: Buffer Overflow
Integer overflow in the getword function in options.c in pppd in Paul's PPP Package (ppp) before 2.4.7 allows attackers to "access privileged options" via a long word in an options file, which triggers a heap-based buffer overflow that "[corrupts] security-relevant variables."
Other sources
Upstream released ppp-2.4.7 which fixes a potential security vulnerability: http://marc.info/?l=linux-ppp&m=140764978420764
There's not much technical details about this issue at this time.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3158?
CVE-2014-3158 is classified as a high severity vulnerability due to its potential to allow attackers to execute arbitrary code via a heap-based buffer overflow.
How do I fix CVE-2014-3158?
To fix CVE-2014-3158, upgrade to ppp package version 2.4.7 or later.
What causes CVE-2014-3158?
CVE-2014-3158 is caused by an integer overflow in the getword function in the pppd program, allowing access to privileged options.
Which versions of PPP are affected by CVE-2014-3158?
Versions of PPP prior to 2.4.7, including 2.4.6 and earlier, are affected by CVE-2014-3158.
What type of vulnerability is CVE-2014-3158?
CVE-2014-3158 is a heap-based buffer overflow vulnerability that can lead to corruption of security-relevant variables.