A possible heap buffer overflow when receiving an l2tp control packet with an AVP which type is a string and no hidden flags, length set to less than 6
Package
l2tp
Affected versions
1.12.0-92-g38b6104
Patched versions
1.12.0-95-g7c04c52b
Impact
Buffer overflow, when receiving an l2tp control packet ith an AVP which type is a string and no hidden flags, length set to less than 6
Severity
If your application is used in open networks or there are untrusted nodes in the network it is highly recommended to apply the patch.
Patches
The problem was patched with commit 2324bcd
Workarounds
As a workaround changes of commit 2324bcd can be applied to older versions.
Credits
swings & leommxj, Chaitin Security Research Lab.