CVE-2015-3310

What it actually does

Buffer overflow in rc_mksid function in the RADIUS plugin when pppd PID exceeds 65535, triggered by a start accounting message, resulting in denial of service via crash.

Why it matters to the business

Disruption of PPP-based remote access or VPN services that rely on RADIUS accounting, potentially affecting user connectivity in legacy network environments.

How an attack unfolds

An attacker sends a crafted RADIUS start accounting message to the server; when the pppd process ID is greater than 65535 the overflow occurs in rc_mksid and crashes the daemon.

How to fix it

Upgrade Paul's PPP Package (ppp) to a version later than 2.4.6 that contains the fix for the rc_mksid buffer handling; apply vendor patches or migrate to a maintained implementation.

How to confirm the fix worked

Confirm ppp version is newer than 2.4.6, review source for corrected rc_mksid bounds checking, and test RADIUS accounting flows under high PID conditions.

Typical attack path

1. Identify target RADIUS server used by pppd
2. Craft and send malicious start accounting request
3. Trigger buffer overflow in rc_mksid when PID > 65535
4. Cause pppd crash and service denial

How to detect it

Review RADIUS server logs for unusual accounting start messages, monitor pppd process crashes or restarts, and inspect system logs around the time of service interruptions.

What your security team should do

• Inventory all systems running ppp 2.4.6 or earlier
• Prioritize upgrade of any internet-facing or critical RADIUS-integrated PPP deployments
• Monitor for service crashes correlated with RADIUS traffic
• Consider disabling RADIUS accounting if not required