CVE-2020-15173CWE-119

Heap buffer overflow in ACCEL-PPP

High · published September 9, 2020

CVSS v3.1
8.2
EPSS
1%
Percentile
67.5
In the wild
Unconfirmed
What it is

In ACCEL-PPP (an implementation of PPTP/PPPoE/L2TP/SSTP), there is a buffer overflow when receiving an l2tp control packet ith an AVP which type is a string and no hidden flags, length set to less than 6. If your application is used in open networks or there are untrusted nodes in the network it is highly recommended to apply the patch. The problem was patched with commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b As a workaround changes of commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b can be applied to older versions.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.01183 · 67.5th percentile
Weakness
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer
Published
2020-09-09T22:45Z
EPSS history
Timeline
  • 09 SEP 22:45Z
    Heap buffer overflow in ACCEL-PPP
    cvelistv5