Information disclosure in PPTP server - CVE-2016-6398
Published: September 7, 2016
Detailed vulnerability description
The vulnerability is caused by incorrect handling of PPTP (Point-to-Point Tunneling Protocol) requests. A remote attacker can send specially crafted PPTP request to vulnerable system and obtain 63 bytes of system memory, which was previously used for sending or receiving PPTP packets.
Successful exploitation of this vulnerability may allow a remote attacker to gain access to potentially sensitive information.
How to mitigate CVE-2016-6398
Cybersecurity Help is currently unaware of any official patch, which addresses this vulnerability.
As a temporary solution the vendor has suggested the following workaround:
To work around this vulnerability, administrators can configure a 64-character local name for any virtual private dialup network (VPDN) group that is enabled for PPTP functionality. This will prevent content from being leaked from memory. The local name must be exactly 64 characters in length.
The following example shows a VPDN group that has a local name consisting of 64 hash marks:
vpdn-group 1
accept-dialin
protocol pptp
virtual-template 1
local name ################################################################