PT-2020-14246

CVE-2020-15173

Published

2020-09-09

Updated

2021-11-18

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ACCEL-PPP (affected versions not specified)

Description A buffer overflow issue occurs when receiving an L2TP control packet with an AVP of type string and no hidden flags, where the length is set to less than 6. This issue is particularly concerning for applications used in open networks or those with untrusted nodes.

Recommendations Apply the patch from commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b to resolve the issue. As a temporary workaround, changes from commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b can be applied to older versions.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-120: Buffer Copy without Checking Size of Input (\'Classic Buffer Overflow\')

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Related identifiers

CVE-2020-15173

GHSA-RR68-FCHR-69VF