Buffer overflow and format string vulnerabilities in ipppd [LWN.net]

Package(s):

i4l

CVE #(s):

Created:

August 14, 2002

Updated:

August 14, 2002

Description:

The ipppd program, in the i4l package, has various buffer overflows and format string bugs. Since ipppd is installed setuid to root, attackers with appropriate group membership may be able to execute arbitrary commands as root. The i4l package for ISDN connectivity is installed by default in at least one distribution; you are vulnerable even if you do not have an ISDN connection.

The SuSE Security Team is aware of a published exploit for ipppd that gives a local attacker root privileges so you should either update the package or remove the setuid bit from ipppd.

Alerts:

SuSE

SuSE-SA:2002:030

2002-08-12

(Log in to post comments)