Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1641

Summary:	Buffer overflows in chat - no obvious security implications
Product:	[Retired] Red Hat Linux	Reporter:	huuskone
Component:	ppp	Assignee:	Michael K. Johnson <johnsonm>
Status:	CLOSED NEXTRELEASE	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	5.1
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	1999-08-28 19:41:55 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description huuskone 1999-03-20 15:06:37 UTC

Various buffers in chat can be overflowed.  However, there is no obvious way to compromise security using these bugs.  Under certain special circumstances an outside attacker could supply an argument to a free() library call.
To reproduce one instance of the bug, type "chat REPORT x ABORT y z" and supply a line of more than 100 x's as input.
I'm working on a patch myself.

Comment 1 Cristian Gafton 1999-07-28 06:54:59 UTC

assigned to johnsonm

Comment 2 Michael K. Johnson 1999-08-28 19:41:59 UTC

appears to be fixed in ppp-2.3.9