// For flags

CVE-2022-4603

ppp pppdump pppdump.c dumpppp array index

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.

Una vulnerabilidad ha sido encontrada en ppp y clasificada como problemática. La función dumpppp del archivo pppdump/pppdump.c del componente pppdump es afectada por la vulnerabilidad. La manipulación del argumento spkt.buf/rpkt.buf conduce a una validación incorrecta del índice de la matriz. Por el momento todavía se duda de la existencia real de esta vulnerabilidad. El nombre del parche es a75fb7b198eed50d769c80c36629f38346882cbf. Se recomienda aplicar un parche para solucionar este problema. VDB-216198 es el identificador asignado a esta vulnerabilidad. NOTA: pppdump no se utiliza en el proceso normal de configuración de una conexión PPP, no se instala con setuid-root y no se invoca automáticamente en ningún escenario.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-12-18 CVE Reserved
  • 2022-12-18 CVE Published
  • 2024-08-03 CVE Updated
  • 2024-08-08 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Samba
Search vendor "Samba"
 Ppp
Search vendor "Samba" for product "Ppp"
 < 2.5.0
Search vendor "Samba" for product "Ppp" and version " < 2.5.0"
linux
Affected
Samba
Search vendor "Samba"
 Ppp
Search vendor "Samba" for product "Ppp"
 < 2.5.0
Search vendor "Samba" for product "Ppp" and version " < 2.5.0"
solaris
Affected