PPPoE (Point-to-Point Protocol over Ethernet) is a protocol used by many ADSL Internet Service Providers. A security vulnerability in the application allows attackers to send a special packet to the rp-pppoe client and cause it to stop responding, effectively causing a Denial of Service attack.
Credit:
The information has been provided by David F. Skoll.
Vulnerable systems:
rp-pppope versions 2.4 and prior
Immune systems:
rp-pppope version 2.5
There is a denial of service vulnerability in rp-pppoe versions up to 2.4. rp-pppoe is a user-space PPPoE client for a bunch of UNIXes and Linux, used by many residential ADSL customers.
If you use the "Clamp MSS" option and someone crafts a TCP packet with a (illegal) "zero-length" option, rp-pppoe will fall into an endless loop. Eventually, the PPP daemon would time out and kill the connection.
