Bug 41508 (CVE-2003-0213)

Summary: VUL-0: CVE-2003-0213: pptp: exploit against pptp daemon
Product: [Novell Products] SUSE Security Incidents Reporter: Marcus Meissner <meissner>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Major    
Priority: P3 - Medium    
Version: unspecified   
Target Milestone: ---   
Hardware: All   
OS: Linux   
Whiteboard: CVE-2003-0213: CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Found By: Other Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Marcus Meissner 2003-04-28 16:18:35 UTC
There is a pptp daemon buffer overflow exploit around, see: 
 
http://www.securityfocus.com/archive/1/319746/2003-04-25/2003-05-01/0
Comment 1 Marcus Meissner 2003-04-28 16:18:35 UTC
<!-- SBZ_reproduce  -->
run exploit found in uzrl? dunno
Comment 2 Marcus Meissner 2003-04-28 16:19:06 UTC
*** Bug 41509 has been marked as a duplicate of this bug. ***
Comment 3 Roman Drahtmueller 2003-04-28 20:30:09 UTC
Thanks for the bugzilla entry, we know it.
Sebastian will be working on this.

R.
Comment 4 Bernhard Kaindl 2003-05-13 00:26:09 UTC
I'm updating the packages right now, many (all) dists are affected, so it will
be some updates. will submit them then to autobuild.
Comment 5 Bernhard Kaindl 2003-05-13 05:08:10 UTC
Submitted these updates:

source got from(/work/SRC/...)    submitted to              to fix dists:

old-versions/7.0-server/all/pptpd /work/src/done/7.0-server 7.0-server-i386
old-versions/7.1/all/pptpd        /work/src/done/7.1        7.1-*
old-versions/7.2/all/pptpd        /work/src/done/7.2        7.2-* sles7-*
old-versions/7.3/all/pptpd        /work/src/done/7.3        7.3-* sles7-ppc
old-versions/8.0/all/pptpd        /work/src/done/8.0        8.0-*
old-versions/8.1/UL/all/pptpd     /work/src/done/8.1        8.1-* sles8-* ul1-*
old-versions/8.2/all/pptpd        /work/src/done/8.2        8.2-*
all/pptpd                         /work/src/done/STABLE     STABLE

Changes:
--------

> Mon May 12 17:14:14 CEST 2003 - bk@suse.de
> 
> - fix pptp daemon buffer overflow with controlpacket length(#26508)
> 
> -------------------------------------------------------------------

New:
----
  ctrlpacket-syslog.dif

+Patch:        ctrlpacket-syslog.dif
+%patch -p1

l -G /work/src/done/STABLE/pptpd
total 269
drwxr-xr-x    2 bk            384 2003-05-12 19:56 ./
drwxrwxrwt   32 root          912 2003-05-12 23:02 ../
-rw-r--r--    1 bk           3478 2002-08-20 12:21 LIESMICH.SuSE
-rw-r--r--    1 bk           2806 2002-08-20 12:21 README.SuSE
-rw-r--r--    1 bk            957 2003-05-12 17:08 ctrlpacket-syslog.dif
-rw-r--r--    1 bk             94 2002-08-20 12:21 options.ppp0
-rw-r--r--    1 bk         116040 2002-08-20 12:21 pptp-install.tar.gz
-rw-r--r--    1 bk         115418 2002-08-20 12:21 pptpd-1.1.2.tar.gz
-rw-r--r--    1 bk           2108 2003-05-12 17:25 pptpd.changes
-rw-r--r--    1 bk           2417 2002-08-20 12:21 pptpd.conf
-rw-r--r--    1 bk           4238 2003-05-12 17:24 pptpd.spec
-rw-r--r--    1 bk           1146 2002-09-17 15:41 rcpptpd

cd /work/src/done
l -Gd */pptpd
drwxr-xr-x    2 bk            496 2003-05-12 19:57 7.0-server/pptpd/
drwxr-xr-x    2 bk            496 2003-05-12 19:57 7.1/pptpd/
drwxr-xr-x    2 bk            496 2003-05-12 17:25 7.2/pptpd/
drwxr-xr-x    2 bk            496 2003-05-12 17:25 7.3/pptpd/
drwxr-xr-x    2 bk            464 2003-05-12 20:43 8.0/pptpd/
drwxr-xr-x    2 bk            384 2003-05-12 19:56 8.1/pptpd/
drwxr-xr-x    2 bk            424 2003-05-12 20:43 8.2/pptpd/
drwxr-xr-x    2 bk            384 2003-05-12 19:56 SLES8/pptpd/
drwxr-xr-x    2 bk            384 2003-05-12 19:56 STABLE/pptpd/
drwxr-xr-x    2 bk            384 2003-05-12 19:56 UL1/pptpd/

Have fun... ;-)
Comment 6 Bernhard Kaindl 2003-05-14 23:57:27 UTC
I forgot to submit the patchinfos. Luckily this gives is the chance to
provide our Maintenance customers with an fix as early as the Box clients
get it if I submit the packages with patchinfos again when Maintenance is
done.

I've also confused the fix for 8.2, where the patch is not added, but
I've copied the whole set of packages needed for putonftps with the
8.2 package fixed to

~bk/packages/submit/done/*

This can be copied to /work/src/done/
 (cp -ap ~bk/packages/submit/done /work/src)
when maintenance is ready.(putonftps are included in the directories already)
Comment 7 Olaf Kirch 2003-05-26 21:30:31 UTC
bk submitted packages, pending approval from QA
Comment 8 Marcus Meissner 2007-03-23 15:52:59 UTC
CVE-2003-0213 I think.
Comment 9 Thomas Biege 2009-10-13 19:45:33 UTC
CVE-2003-0213: CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)