CVE-2020-8597 rhostname buffer overflow in pppd

eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.

Recent assessments:

wvu-r7 at March 10, 2020 6:33pm UTC reported:

AFAIK, it is common to enable full mitigations on the binary, with ASLR enabled on the system. While this doesn’t mean much in and of itself, it could mean the vulnerability is difficult or “impossible” to exploit, depending on how the software is engineered or configured. A crash has already been proven.

busterb at April 10, 2020 7:44pm UTC reported:

AFAIK, it is common to enable full mitigations on the binary, with ASLR enabled on the system. While this doesn’t mean much in and of itself, it could mean the vulnerability is difficult or “impossible” to exploit, depending on how the software is engineered or configured. A crash has already been proven.

Assessed Attacker Value: 1
Assessed Attacker Value: 1Assessed Attacker Value: 3