What’s Vulnerable › Vulnerabilities
CVE-2020-8597
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 19.9% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-02-03 · updated 2026-06-17
- Weakness: CWE-120
Description
eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.
Affected products
- Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 18.04, 19.04
- Debian Linux: 9.0, 10.0
- Point-To-Point Protocol Project Point-To-Point Protocol: from 2.4.2 through 2.4.8
- WAGO Pfc Firmware: before 03.04.10\(16\) — fixed in 03.04.10\(16\)
How to fix
Upgrade to a fixed version: WAGO Pfc Firmware 03.04.10\(16\). Check the vendor advisory for mitigations.
References
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00006.html
- http://packetstormsecurity.com/files/156662/pppd-2.4.8-Buffer-Overflow.html
- http://packetstormsecurity.com/files/156802/pppd-2.4.8-Buffer-Overflow.html
- http://seclists.org/fulldisclosure/2020/Mar/6
- https://access.redhat.com/errata/RHSA-2020:0630
- https://access.redhat.com/errata/RHSA-2020:0631
- https://access.redhat.com/errata/RHSA-2020:0633
- https://access.redhat.com/errata/RHSA-2020:0634
- https://cert-portal.siemens.com/productcert/pdf/ssa-809841.pdf
- https://github.com/paulusmack/ppp/commit/8d7970b8f3db727fe798b65f3377fe6787575426
- https://kb.netgear.com/000061806/Security-Advisory-for-Unauthenticated-Remote-Buffer-Overflow-Attack-in-PPPD-on-WAC510-PSV-2020-0136
- https://lists.debian.org/debian-lts-announce/2020/02/msg00005.html
Get alerted when CVE-2020-8597 or the next vulnerability affects your stack