Timo Sirainen writes:
> Versions older than 1.1.4-b3 and 1.1.3-20030409 affected. This seems to be
> exploitable only with Linux.
...
> problem
> -------
...
>
> if (length > PPTP_MAX_CTRL_PCKT_SIZE) {
> // abort
> }
Version 1.1.3 does not have this vulnerability. My copy of 1.1.3
ctrlpacket.c (dated Feb 11 2002) reads
if (length <= 0 || length > PPTP_MAX_CTRL_PCKT_SIZE) {
My copies of versions 1.0.1 and 1.1.2 do have the vulerability.
--
Dick St.Peters, stpeters@NetHeaven.com
