CVE-2014-3158 Integer overflow in n/a
An integer overflow in pppd allows attackers to corrupt security variables and gain privileged access via a long word in an options file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-3158?
CVE-2014-3158 is a high-severity vulnerability in n/a, published on 15 Nov 2014. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Integer overflow in the getword function in options.c in pppd in Paul's PPP Package (ppp) before 2.4.7 allows attackers to "access privileged options" via a long word in an options file, which triggers a heap-based buffer overflow that "[corrupts] security-relevant variables."
Weakness: CWE-119
Which versions are affected by CVE-2014-3158?
It affects 1 product.
Products include Point-to-Point Protocol Project Point-to-Point Protocol.
How do I fix CVE-2014-3158?
Upgrade to a fixed version.
Is CVE-2014-3158 being exploited?
There is no known exploitation of CVE-2014-3158 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2014-3158, DLA-74-1, DSA-3079-1, GHSA-4rmp-xhjh-jrfr, MGASA-2014-0368, UBUNTU-CVE-2014-3158 and 1 more.