Number: AV20-056
Date: 05 March 2020
Several Linux distributions have released security updates to address vulnerabilities in their respective operating systems. Of note is a vulnerability in the Point-to-Point Protocol Daemon (pppd) versions 2.4.2 through 2.4.8.
Due to a flaw in the Extensible Authentication Protocol (EAP) packet processing in the Point-to-Point Protocol Daemon (pppd), an unauthenticated remote actor may be able to cause a stack buffer overflow, allowing for arbitrary code execution on the target system.
Linux operating systems affected by this vulnerability include Debian, Ubuntu, Red Hat, and Suse. Please note that this is not an exhaustive list and that other versions of Linux may be affected. Several security bulletins have been released and the Cyber Centre encourages users and administrators to review the applicable bulletins listed below and apply the necessary updates.
Debian: https://security-tracker.debian.org/tracker/CVE-2020-8597
Ubuntu: https://usn.ubuntu.com/4288-1/
Red Hat: https://access.redhat.com/errata/RHSA-2020:0630
Suse: https://www.suse.com/security/cve/CVE-2020-8597/
Note to Readers
The Canadian Centre for Cyber Security (Cyber Centre) operates as part of the Communications Security Establishment. We are Canada’s national authority on cyber security and we lead the government’s response to cyber security events. As Canada's national computer security incident response team, the Cyber Centre works in close collaboration with government departments, critical infrastructure, Canadian businesses and international partners to prepare for, respond to, mitigate, and recover from cyber events. We do this by providing authoritative advice and support, and coordinating information sharing and incident response. The Cyber Centre is outward-facing, welcoming partnerships that help build a stronger, more resilient cyber space in Canada.