Vulnerability · Published Oct 6, 2020 · Assigned by freebsd
CVE-2020-7466
High 7.5
In plain English
A high-severity out-of-bounds read in MPD: FreeBSD PPP daemon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities).
Severity (CVSS NVD)7.5High
Exploit odds (30 days)2.0%top 19.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The PPP implementation of MPD before 5.9 allows a remote attacker who can send specifically crafted PPP authentication message to cause the daemon to read beyond allocated memory buffer, which would result in a denial of service condition.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | MPD: FreeBSD PPP daemon | All versions prior to version 5.9 |
Weakness: CWE-125
References
- https://sourceforge.net/p/mpd/svn/2374/ x_refsource_MISC
- https://sourceforge.net/p/mpd/bugs/69/ x_refsource_MISC