CVE-2022-4603 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Samba PPP

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer6 documents6 sources
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 64.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Samba PPPDebian PPPMsrc Cbl2 PPP 2.4.7-36 ON CBL Mariner 2.0
Timeline
PublishedDec 18
Latest updateDec 19

Description

A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerabil…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶NVDsamba/ppp< 2.5.0
▶debiandebian/ppp< ppp 2.5.0-1+2 (forky)
▶Debiansamba/ppp< 2.5.0-1+2+1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
OSV
CVE-2022-4603: A vulnerability classified as problematic has been found in ppp↗2022-12-18
▶
GHSA
GHSA-82mr-xx64-4rjv: ** DISPUTED ** A vulnerability classified as problematic has been found in ppp↗2022-12-18
▶

📋Vendor Advisories

3
Red Hat
ppp: improper validation of array index of the component pppdump↗2022-12-19
▶
Microsoft
ppp pppdump pppdump.c dumpppp array index↗2022-12-13
▶
Debian
CVE-2022-4603: ppp - A vulnerability classified as problematic has been found in ppp. Affected is the...↗2022
▶