Linux systems are in danger due to a 17-year-old critical remote code execution vulnerability that affects the PPP Daemon (Point to Point Protocol Daemon) software implemented in almost all Linux based operating systems, as well as the firmware of many other networking devices, the US-CERT warned.

The pppd software is an implementation of Point-to-Point Protocol (PPP) that is used to establish internet links over dial-up modems, DSL connections, and many other types of point-to-point links.

According to a new security advisory, pppd versions 2.4.2 through 2.4.8 are vulnerable to buffer overflow due to a flaw (CVE-2020-8597) in Extensible Authentication Protocol (EAP) packet processing in eap_request and eap_response subroutines. This flaw allows an unauthenticated remote attacker to execute an arbitrary code and takeover the target system. The issue can be exploited by sending an unsolicited EAP packet to a vulnerable ppp client or server which will cause memory corruption in the pppd process.

The vulnerability exists because of “an error in validating the size of the input before copying the supplied data into memory. As the validation of the data size is incorrect, arbitrary data can be copied into memory and cause memory corruption possibly leading to execution of unwanted code”.

“The vulnerability is in the logic of the eap parsing code, specifically in the eap_request() and eap_response() functions in eap.c that are called by a network input handler. These functions take a pointer and length as input using the the first byte as a type. If the type is EAPT_MD5CHAP(4), it looks at an embedded 1-byte length field. The logic in this code is intended to makes sure that embedded length is smaller than the whole packet length. After this verification, it tries to copy provided data (hostname) that is located after the embedded length field into a local stack buffer. This bounds check is incorrect and allows for memory copy to happen with an arbitrary length of data”, the security advisory explained.

Furthermore, since the pppd often runs with high privileges (system or root) and works in conjunction with kernel drivers it allows an attacker to potentially execute arbitrary code with system or root level privileges.

The following Linux distributions has been confirmed as affected by this vulnerability:

· Debian

· Ubuntu

· SUSE Linux

· Fedora

· NetBSD

· Red Hat Enterprise Linux

Since there is no viable work around the only way to mitigate this vulnerability is to patch the software with updated software made available by the software vendors.