Argus

**Name of the Vulnerable Software and Affected Versions** OpenBSD versions prior to 7.6 **Description** An authentication bypass exists in the `sppp pap input` function within `sys/net/if spppsubr.c`. The issue occurs when a PAP Auth-Request is sent with `name len` and `passwd len` set to zero. Because the system only checked these lengths against a maximum limit and then passed them to `bcmp()`, a length of zero caused `bcmp()` to return zero regardless of the actual content, allowing the credential check to be satisfied. This path is reachable over PPPoE via `pppoe data input`, `pppoeintr`, and `sppp input`. Additionally, the lack of a lower-bound test can lead to a kernel heap over-read if `name len` exceeds the allocated credential buffer. Real-world offensive activities targeting this issue have been identified. **Recommendations** Update OpenBSD to version 7.6 or later.