Bug 768234 (CVE-2020-28194)

Summary:	net-dialup/accel-ppp: Remote code execution (CVE-2020-28194)
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	pinkbyte
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-2m44-rh3c-x4gr
Whiteboard:	~2 [ebuild]
Package list:		Runtime testing required:	---

Description Sam James archtester

2021-02-01 15:29:49 UTC

Description:
"Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length field is less than 2. It has an impact only when the attacker controls the RADIUS server, which can lead to arbitrary code execution."

Comment 1 Sam James archtester

2021-02-01 15:30:35 UTC

Please bump to a commit equal to or after https://github.com/accel-ppp/accel-ppp/commit/e9d369aa0054312b7633e964e9f7eb323f1f3d69 as per the advisory linked.

Comment 2 Larry the Git Cow gentoo-dev

2021-05-17 08:57:50 UTC

The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=aabfd1c8c3ccd7085da46a10edb29d45811ba2c3

commit aabfd1c8c3ccd7085da46a10edb29d45811ba2c3
Author:     Sergey Popov <pinkbyte@gentoo.org>
AuthorDate: 2021-05-17 08:50:46 +0000
Commit:     Sergey Popov <pinkbyte@gentoo.org>
CommitDate: 2021-05-17 08:57:48 +0000

    net-dialup/accel-ppp: drop old vulnerable version
    
    Closes: https://bugs.gentoo.org/768234
    Package-Manager: Portage-3.0.18, Repoman-3.0.2
    Signed-off-by: Sergey Popov <pinkbyte@gentoo.org>

 net-dialup/accel-ppp/Manifest                      |   1 -
 .../accel-ppp-1.12.0_p20200913-r100.ebuild         | 113 ---------------------
 2 files changed, 114 deletions(-)