Re: PoPToP PPTP server remotely exploitable buffer overflow

["Dick St.Peters" <stpeters () NetHeaven com>]

Timo Sirainen writes:
> Versions older than 1.1.4-b3 and 1.1.3-20030409 affected. This seems to be
> exploitable only with Linux.
 ...
> problem
> -------
 ...
>       if (length > PPTP_MAX_CTRL_PCKT_SIZE) {
>         // abort
>       }

Version 1.1.3 does not have this vulnerability.  My copy of 1.1.3
ctrlpacket.c (dated Feb 11 2002) reads

    if (length <= 0 || length > PPTP_MAX_CTRL_PCKT_SIZE) {

My copies of versions 1.0.1 and 1.1.2 do have the vulerability.

--
Dick St.Peters, stpeters () NetHeaven com