Microsoft pptp vpn vulnerabilities Exploits in Action

© SANS Institute 2000 - 200
                                                5
, Author retains full rights.
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
© SANS Institute 2000 - 200
5                                                                                                                 
Author retains full rights.
19
allows remote attackers to cause a denial of service via a 
malformed data packet, aka the "Malformed PPTP Packet Stream" 
vulnerability.
CVE-2001-0204 Memory leak in PPTP server in Windows NT 4.0 
•
allows remote attackers to cause a denial of service via a 
malformed data packet, aka the "Malformed PPTP Packet Stream" 
vulnerability.
CVE-2001-1183 PPTP implementation in Cisco IOS 12.1 and 12.2 
•
allows remote attackers to cause a denial of service (crash) via a 
malformed packet.
CAN-1999-0140 ** CANDIDATE (under review) ** Denial of service 
•
in RAS/PPTP on NT systems.
CAN-2002-0602 ** CANDIDATE (under review) ** Snapgear Lite+ 
•
firewall 1.5.4 and 1.5.3 allows remote attackers to cause a denial 
of service (crash) via a large number of connections to (1) the 
HTTP web management port, or (2) the PPTP port.
CVE-1999-0160 Some classic Cisco IOS devices have a 
•
vulnerability in the PPP CHAP authentication to establish 
unauthorized PPP connections.
Surprisingly there were no CVE or CAN numbers found via the sites 
search, listed for GRE, MPPC, MPPE, MS CHAP, and other related 
vulnerabilities, even though various exploits, tools, and vulnerabilities were found
during the research for this document on PPTP.