Executive brief
A vulnerability in the Point-to-Point Protocol (PPP) utility in FreeBSD 2.1 and earlier could allow a local user to gain administrative control over the system. By providing an unusually long piece of data in a specific system setting (the HOME environment variable), an attacker can crash the program and execute their own commands. This could lead to a complete takeover of the affected machine by a user who already has basic access.
Technical details
A stack-based buffer overflow exists in the ppp utility of FreeBSD 2.1 and earlier. The vulnerability is triggered when the program processes an overly long HOME environment variable without proper bounds checking. Because the ppp binary is typically installed with setuid root privileges to manage network interfaces, an attacker can exploit this overflow to overwrite the instruction pointer and execute arbitrary code with root privileges. This is a local attack requiring the attacker to already have shell access to the system. A patch was released by the FreeBSD Project in 1996 (FreeBSD-SA-96:20).
Affected products
- FreeBSD Project FreeBSD 2.1 and earlier
Timeline
- 1996-12-19: disclosed: Exploit code published by Leshka Zakharoff
- 1996-12-19: advisory: FreeBSD Security Advisory SA-96:20 issued