CVE-2018-11574

Improper input validation together with an integer overflow in the EAP-TLS protocol implementation in PPPD may cause a crash, information disclosure, or authentication bypass. This implementation is distributed as a patch for PPPD 0.91, and includes the affected eap.c and eap-tls.c files. Configurations that use the refuse-app option are unaffected.

Published: Jun 14, 2018
Updated: Apr 13, 2023
CVE: CVE-2018-11574
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: High
Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

CWE-20
CWE-190

Affected Software
References

Software	From	Fixed in
point-to-point_protocol_project / point-to-point_protocol	-	2.4.9
canonical / ubuntu_linux	14.04	14.04.x
canonical / ubuntu_linux	16.04	16.04.x
canonical / ubuntu_linux	18.04	18.04.x

http://www.openwall.com/lists/oss-security/2018/06/11/1
https://usn.ubuntu.com/3810-1/

Vulnerability Database

CVE-2018-11574

Deep Security Visibility Without the Complexity