CVE-2015-3310: Buffer Overflow
Published Apr 12, 2015
·Updated
Buffer overflow in the rcmksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial of service (crash) via a start accounting message to the RADIUS server.
Affected Software
6 affected componentsFixes available
debian/ppp
2.4.9-1+12.4.9-1+1.12.5.0-1+2
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=14.10
Debian Debian Linux=7.0
Point-to-point Protocol Project Point-to-point Protocol<=2.4.6
Event History
Apr 12, 2015
Data Sourced
via Debian·12:21 PM
SeverityAffected Software
Apr 24, 2015
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Aug 6, 2024
Data Sourced
via Debian·05:52 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-3310?
CVE-2015-3310 has a severity rating that allows remote attackers to cause a denial of service, indicating a significant risk.
2
How do I fix CVE-2015-3310?
To fix CVE-2015-3310, upgrade to ppp version 2.4.9-1+1 or higher.
3
Which versions of ppp are affected by CVE-2015-3310?
CVE-2015-3310 affects ppp versions 2.4.6 and earlier.
4
Can I be attacked remotely with CVE-2015-3310?
Yes, CVE-2015-3310 allows remote attackers to exploit the vulnerability.
5
What is the cause of the buffer overflow in CVE-2015-3310?
The buffer overflow in CVE-2015-3310 is caused by handling the PID for pppd when it exceeds 65535.