A remote overflow exists in l2tpd. The l2tpd program fails to check the boundary in the write_packet() function in control.c, resulting in a buffer overflow. By establishing an L2TP tunnel and then sending a specially crafted packet, a remote attacker can overflow a buffer, resulting in a loss of integrity.

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

• Security Tracker: 1010406
• Secunia Advisory ID: 11788 12096 12128
• CVE ID: 2004-0649 (see also: NVD)
• Other Advisory URL: http://lists.debian.org/debian-security-announce/debian-security-announce-2004/msg00131.html
  http://www.gentoo.org/security/en/glsa/glsa-200407-17.xml
• Mail List Post: http://seclists.org/lists/bugtraq/2004/Jun/0073.html
• Vendor Specific News/Changelog Entry: http://www.cyberguard.info/snapgear/releases.html
• Vendor URL: http://www.l2tpd.org/

• Thomas Walpuski - thomas-bugtraqunproved.org -