Privilege Mismanagement in pppd Passprompt Plugin - CVE-2024-58250
Summary
CVE-2024-58250: The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges. Affects ppp versions < 0a66ad22e54c72690ec2a29a019767c55c5281fc. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ppp (Point-to-Point Protocol) package is a widely used software suite that facilitates the establishment of direct connections between network nodes. It is commonly utilized for dial-up connections and VPNs. The passprompt plugin within pppd (PPP daemon) is responsible for handling user authentication prompts. This vulnerability arises from improper privilege handling, which could potentially allow unauthorized users to gain elevated privileges.
Vulnerability Detail
CVE-2024-58250 is a vulnerability found in the passprompt plugin of pppd in versions prior to 2.5.2. The flaw stems from the mishandling of privileges, which could enable an attacker to exploit this weakness and execute arbitrary code with elevated privileges. This could lead to unauthorized access, data breaches, or system compromise, making it critical for users of affected versions to address this vulnerability promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the pppd service or disable the passprompt plugin until the package is updated. This can be done by modifying the configuration files to prevent unauthorized access.
Conclusion
CVE-2024-58250 represents a significant security risk due to improper privilege handling in the pppd passprompt plugin. Users are strongly advised to update to the latest version of the ppp package to mitigate this vulnerability. For those unable to update immediately, temporary workarounds are available to reduce risk.
See every vulnerability recorded for ppp →
FAQ
CVE-2024-58250 is a vulnerability in the passprompt plugin of the pppd in ppp versions before 2.5.2, which mishandles privileges.
This vulnerability can allow unauthorized users to gain elevated privileges, potentially leading to system compromise or data breaches.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, consider restricting access to the pppd service or disabling the passprompt plugin as a temporary measure.
More details can be found in the official CVE database or by visiting the source link provided in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for ppp.
