[ GLSA 200705-18 ] PPTPD: Denial of Service attack

[GLSA]

Gentoo Linux Security Advisory

Title: PPTPD: Denial of Service attack (GLSA 200705-18)
Severity: normal
Exploitable: remote
Date: May 20, 2007
Bug(s): #176936
ID: 200705-18

Synopsis


A vulnerability has been reported in PPTPD which could lead to a Denial of
Service.


Background


PPTPD is a Point-to-Point Tunnelling Protocol Daemon for Linux.


Affected Packages

Package: net-dialup/pptpd
Vulnerable: < 1.3.4
Unaffected: >= 1.3.4
Architectures: All supported architectures


Description


James Cameron from HP has reported a vulnerability in PPTPD caused by
malformed GRE packets.


Impact


A remote attacker could exploit this vulnerability to cause a Denial of
Service on the PPTPD connection.


Workaround


There is no known workaround at this time.


Resolution


All PPTPD users should upgrade to the latest version: