Page MenuHomeVyOS Platform
Create Task
Maniphest T9282

Accel-ppp-ng: RADIUS: rad_packet_recv() reads data beyond packet length field
In progress, NormalPublic
Actions

Description

rad_packet_recv() currently parses attributes based on the received byte count (bytes_read-20) rather than the packet length field (pack->len). This can allow attributes beyond pack->len to be processed even though they are not authenticated.

Details

Version
rolling
Is it a breaking change?
Perfectly compatible
Issue type
Security vulnerability

Related Objects

Event Timeline

RC created this task.Sun, Sep 6, 8:23 AM
RC changed the task status from Open to In progress.
RC triaged this task as Normal priority.
RC created this object with visibility "Administrators".
RC created this object with edit policy "Administrators".
RC added a comment.Tue, Sep 8, 4:22 PM

https://github.com/accel-ppp/accel-ppp-ng/pull/41

Viacheslav changed the visibility from "Administrators" to "Public (No Login Required)".Thu, Sep 10, 2:10 PM
Viacheslav changed the edit policy from "Administrators" to "Maintainers (Project)".
Viacheslav changed Version from - to rolling.
Viacheslav changed Is it a breaking change? from Unspecified (possibly destroys the router) to Perfectly compatible.
Viacheslav changed Issue type from Unspecified (please specify) to Security vulnerability.
pasik subscribed.Thu, Sep 10, 4:24 PM
RC mentioned this in T9325: Accel-ppp-ng: RADIUS and DHCPv6: Follow-up hardening for PR #40 security fixes.Tue, Sep 15, 11:30 PM