PatchTheCVEl2tpd vulnerabilities and fixes
Recent CVEs affecting l2tpd, with upgrade or downgrade steps. 3 tracked.
l2tpd has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2004-08-06. Highest priority: CVE-2004-0649 (score 63/100).
- CVE-2004-0649 HIGH 10.0 DOWNGRADE MITIGATE Buffer overflow in write_packet in control.c for l2tpd may allow remote attackers to execute arbitrary code.
- CVE-2002-0873 MEDIUM 5.0 DOWNGRADE Vulnerability in l2tpd 0.67 allows remote attackers to overwrite the vendor field via a long value in an attri
- CVE-2002-0872 HIGH 7.5 DOWNGRADE l2tpd 0.67 does not initialize the random number generator, which allows remote attackers to hijack sessions.
FAQ
How do I fix l2tpd vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is l2tpd being exploited right now?
None of the tracked l2tpd CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which l2tpd CVE should I patch first?
CVE-2004-0649 currently ranks highest (63/100): Buffer overflow in write_packet in control.c for l2tpd may allow remote attackers to execute arbitrary code..