[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

pppd MSCHAP authentication bug



I have rediscovered a bug in /usr/sbin/pppd provided in OpenBSD 3.4 and 
have successfully demonstrated the bug and the fix on an i386 platform.  
The bug has not been confirmed on 3.5

The bug is described in the last post here:
http://dbforums.com/arch/181/2002/5/358412

Briefly, the bug exists because of differences in the md4 routines used 
on Linux and BSD.

I don't have access to the source right now, but if you grep for 
'secret_len * 2 * 8' you will find the line quite easily.  The fix is to 
change this to 'secret_len * 2'

The fix should be attributed to the original poster rather than me; I 
only read the post and confirmed it's validity.

Thanks!!!!!
    Peter