{"vuid":"VU#841742","idnumber":"841742","name":"Apple Mac OS X Point-to-Point Protocol daemon (pppd) contains format string vulnerability","keywords":["Apple","Mac OS X","Point-to-Point Protocol daemon","pppd","vslprintf()","vsnprintf()"],"overview":"Apple Mac OS X Point-to-Point Protocol daemon contains a format string vulnerability in the handling of invalid command line arguments.","clean_desc":"The Point-to-Point Protocol (PPP) provides a method for transmitting datagrams over serial point-to-point links. There is a format string vulnerability in the Mac OS X Point-to-Point Protocol daemon (pppd). When pppd receives an invalid command line argument, this argument is passed to the fslprintf() function. This function accepts input without properly specifying a format string. According to @stake: The vulnerability is in a function specific to pppd that does not allow for traditional exploitation (arbitrary data written to arbitrary memory locations) via %n. However, it is possible to read arbitrary data out of pppd's process. Under certain circumstances, it is also possible to 'steal' PAP/CHAP authentication credentials.","impact":"The complete impact of this vulnerability is not yet known. However, exploitation may lead to the ability to read arbitrary data out of pppd's process. This data may contain CHAP or PAP authentication credentials.","resolution":"Apply Patch\nApple has released a patch to address this vulnerability. For further details, please see the Apple Security Advisory (Security Update 2004-02-23).","workarounds":"","sysaffected":"","thanks":"This vulnerability was reported by Dave G. of @stake and Justin Tibbs of Secure Network Operations (SRT).","author":"This document was written by Damon Morda.","public":["http://www.atstake.com/research/advisories/2004/a022304-1.txt","http://www.apple.com/support/security/security_updates.html"],"cveids":["CVE-2004-0165"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2004-02-24T18:14:29Z","publicdate":"2004-02-24T00:00:00Z","datefirstpublished":"2004-02-26T15:23:49Z","dateupdated":"2004-02-26T15:23:58Z","revision":15,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"15","cam_exploitation":"0","cam_internetinfrastructure":"10","cam_population":"13","cam_impact":"8","cam_easeofexploitation":"8","cam_attackeraccessrequired":"10","cam_scorecurrent":"3.9","cam_scorecurrentwidelyknown":"4.68","cam_scorecurrentwidelyknownexploited":"7.8","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":3.9,"vulnote":null}