PPTPD: Denial of Service attack — GLSA 200705-18

A vulnerability has been reported in PPTPD which could lead to a Denial of Service.

Package	net-dialup/pptpd on all architectures
Affected versions	< 1.3.4
Unaffected versions	>= 1.3.4

PPTPD is a Point-to-Point Tunnelling Protocol Daemon for Linux.

James Cameron from HP has reported a vulnerability in PPTPD caused by malformed GRE packets.

A remote attacker could exploit this vulnerability to cause a Denial of Service on the PPTPD connection.

There is no known workaround at this time.

All PPTPD users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-dialup/pptpd-1.3.4"

Release date
May 20, 2007

Latest revision
May 20, 2007: 01

Severity
normal

Exploitable
remote

Bugzilla entries