Test ID:	1.3.6.1.4.1.25623.1.0.53369
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-295)
Summary:	The remote host is missing an update for the Debian 'pptpd' package(s) announced via the DSA-295 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'pptpd' package(s) announced via the DSA-295 advisory. Vulnerability Insight: Timo Sirainen discovered a vulnerability in pptpd, a Point to Point Tunneling Server, which implements PPTP-over-IPSEC and is commonly used to create Virtual Private Networks (VPN). By specifying a small packet length an attacker is able to overflow a buffer and execute code under the user id that runs pptpd, probably root. An exploit for this problem is already circulating. For the stable distribution (woody) this problem has been fixed in version 1.1.2-1.4. For the old stable distribution (potato) this problem has been fixed in version 1.0.0-4.2. For the unstable distribution (sid) this problem has been fixed in version 1.1.4-0.b3.2. We recommend that you upgrade your pptpd package immediately. Affected Software/OS: 'pptpd' package(s) on Debian 3.0. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2003-0213 BugTraq ID: 7316 http://www.securityfocus.com/bid/7316 Bugtraq: 20030409 PoPToP PPTP server remotely exploitable buffer overflow (Google Search) http://www.securityfocus.com/archive/1/317995 Bugtraq: 20030418 Exploit for PoPToP PPTP server (Google Search) http://marc.info/?l=bugtraq&m=105068728421160&w=2 Bugtraq: 20030422 Re: Exploit for PoPToP PPTP server - Linux version (Google Search) http://www.securityfocus.com/archive/1/319428 Bugtraq: 20030428 GLSA: pptpd (200304-08) (Google Search) http://marc.info/?l=bugtraq&m=105154539727967&w=2 CERT/CC vulnerability note: VU#673993 http://www.kb.cert.org/vuls/id/673993 Debian Security Information: DSA-295 (Google Search) http://www.debian.org/security/2003/dsa-295 SuSE Security Announcement: SuSE-SA:2003:029 (Google Search) http://www.novell.com/linux/security/advisories/2003_029.html
Copyright	Copyright (C) 2008 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.