VYPR
← All advisories
Unrated severityNVD Advisory· Published Feb 3, 2020· Updated Dec 3, 2025

CVE-2020-8597

CVE-2020-8597

Description

eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

29

Patches

Vulnerability mechanics

Root cause

"Missing bounds checking on the rhostname buffer in eap_request and eap_response allows a stack buffer overflow when processing unsolicited EAP packets."

Attack vector

An unauthenticated remote attacker sends an unsolicited EAP packet to a vulnerable ppp client or server [ref_id=1]. The pppd code in `eap_input` processes the packet even if ppp refused the authentication negotiation due to lack of EAP support or a mismatched pre-shared passphrase [ref_id=1]. This unverified data with an unknown size triggers a stack buffer overflow in the `rhostname` buffer within `eap_request` and `eap_response` [ref_id=1]. The pppd process often runs with system or root privileges, making arbitrary code execution possible [ref_id=1].

Affected code

The vulnerability resides in the `eap_request` and `eap_response` functions within `eap.c` of pppd, affecting ppp versions 2.4.2 through 2.4.8. The `rhostname` buffer is overflowed when processing EAP packets without proper bounds checking [ref_id=1].

What the fix does

The advisory recommends applying the latest patches from the software vendor [ref_id=1]. The fix is available in the ppp Git repository at commit 8d45443bb5c9372b4c6a362ba2f443d41c5636af, and for lwIP at commit 2ee3cbe69c6d2805e64e7cac2a1c1706e49ffd86 [ref_id=1]. No workaround exists other than patching [ref_id=1].

Preconditions

  • networkThe attacker must be able to send network packets to a vulnerable ppp client or server
  • authNo authentication or prior EAP negotiation is required; the vulnerable code processes unsolicited EAP packets even when EAP was not negotiated
  • configThe target must be running pppd version 2.4.2 through 2.4.8, or lwIP configured with EAP enabled at compile time
  • inputThe attacker sends a crafted EAP packet with an oversized rhostname field

Reproduction

A proof-of-concept for testing PPTP server vulnerability is available in the CERT/CC PoC repository at https://github.com/CERTCC/PoC-Exploits/tree/master/cve-2020-8597-pptpd [ref_id=1]. A Snort/Suricata IDS rule to detect exploitation attempts is also provided in that repository [ref_id=1].

Generated on May 27, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

22

News mentions

0

No linked articles in our index yet.