Mu identifies pre-authentication vulnerability in Mac OS X kernel PPP driver

Dark Reading Staff, Dark Reading

November 28, 2006

1 Min Read

SUNNYVALE, Calif. -- Product Overview: PPP is the protocol used for establishing internet links over dial-up modems, DSL connections, and many other types of point-to-point links. The PPPD daemon works together with the kernel PPP driver to establish and maintain a PPP link with another system (called the peer) and to negotiate IP addresses for each end of the link. PPPD can also authenticate the peer and/or supply authentication information to the peer. PPP can be used with other network protocols besides IP, but such use is becoming increasingly rare.

Vulnerability Details: The network kernel extension com.apple.nke.pppoe that works concurrently with the PPPD has a critical vulnerability that may lead to arbitrary code execution with system privileges. The vulnerability is triggered by sending a malformed PADI packet with invalid lengths to the PPP daemon. PADI is the first message in a PPPoE link establishment and requires no credentials. In addition, the MAC address of the sender can be spoofed. Users of PPP who do not create PPPoE connections are not at risk of attack. PPPoE is also not enabled by default.

Mu Security Inc.

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights