Timo Sirainen writes:
> Versions older than 1.1.4-b3 and 1.1.3-20030409 affected. This seems to be
> exploitable only with Linux.
...
> problem
> -------
...
>
> if (length > PPTP_MAX_CTRL_PCKT_SIZE) {
> // abort
> }

Version 1.1.3 does not have this vulnerability. My copy of 1.1.3
ctrlpacket.c (dated Feb 11 2002) reads

if (length <= 0 || length > PPTP_MAX_CTRL_PCKT_SIZE) {

My copies of versions 1.0.1 and 1.1.2 do have the vulerability.

--
Dick St.Peters, stpeters (at) NetHeaven (dot) com [email concealed]

[ reply ]