Notre sélection d'alertes et avis SSI.
Sources : US Cert, Cert EU, Cert FR, Cnil, VulDB.

vendredi 6 mars 2020

Critical PPP Daemon Vulnerability (CERT-EU Security Advisory 2020-013)

A new dangerous (and 17 years old!) remote code execution vulnerability has been discovered by Ilja Van Sprundel from IOActive. It affects the PPP daemon ("pppd") software that comes installed on almost all Linux-based operating systems and powers the firmware of many other networking devices. The affected "pppd" software is an implementation of Point-to-Point Protocol (PPP) that enables communication and data transfer between nodes, primarily used to establish Internet links such as those over dial-up modems, DSL broadband connections, and Virtual Private Networks. The vulnerability is tracked as CVE-2020-8597 with "CVSS Score 9.8" and can be exploited by unauthenticated attackers to remotely execute arbitrary code on affected systems and take full control over them.

Lien vers l'article source

Auteur: Cert EU

Catégories: CertEUNombre de vues: 274


Événements SSI