high7.5Public exploit code

CVE-2003-0213

ctrlpacket.c in PoPToP PPTP server before 1.1.4-b3 allows remote attackers to cause a denial of service via a length field of 0 or 1, which causes a negative v…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

PoPToP PPTP 1.0/1.1.x - Negative 'read()' Argument Remote Buffer Overflow2003-04-09 · remote · linux · Verified
PoPToP - Negative Read Overflow (Metasploit)2010-11-23 · remote · linux · Verified
PoPToP < 1.1.3-b3/1.1.3-20030409 - Negative Read Overflow (Metasploit)2003-04-09 · remote · linux · Verified
PoPToP PPTP 1.1.4-b3 - 'poptop-sane.c' Remote Command Execution2003-04-25 · remote · linux · Verified
PoPToP PPTP 1.1.4-b3 - Remote Command Execution2003-04-18 · remote · linux · Verified

Impact

ctrlpacket.c in PoPToP PPTP server before 1.1.4-b3 allows remote attackers to cause a denial of service via a length field of 0 or 1, which causes a negative value to be fed into a read operation, leading to a buffer overflow.

Affected products

Vendor	Product	Affected versions
Poptop	Pptp Server	Versions 1.0.1, 1.1.2, 1.1.3, 1.1.3_2002-10-09, 1.1.4b1, 1.1.4b2

Public exploit code

Impact

Affected products

References