We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Lobsters·Jun 17·5 min read
A 27-Year-Old Authentication Bypass in OpenBSD's PPP Stack
TL;DR
A vulnerability existed in OpenBSD's PPP (Point-to-Point Protocol) stack, allowing attackers to bypass PAP (Password Authentication Protocol) authentication. The issue stemmed from using attacker-controlled length fields in the bcmp function, which compares credentials.
✦ Why It Matters
Engineers must validate all user inputs to prevent security vulnerabilities like authentication bypasses.
Key Takeaways
- Always validate user input lengths before processing.
- Conduct regular code reviews to catch vulnerabilities early.
- Implement automated testing for security checks.
- Stay informed about historical vulnerabilities in software.
Full Summary
OpenBSD's sppp_pap_input function, responsible for handling PAP authentication in PPP connections, contained a critical flaw since its introduction in 1999. The vulnerability arose because the lengths of the username and password fields were derived from the incoming data, allowing an attacker to manipulate them.
Specifically, using zero-length fields in the bcmp function would always return a match, effectively bypassing authentication checks. This bug remained undetected for nearly three decades, emphasizing the need for rigorous code reviews and testing.
The fix involved ensuring that the lengths used in bcmp were validated and not directly taken from user input. This incident serves as a reminder of the potential longevity of security vulnerabilities and the importance of maintaining vigilance in software development.
Engineers should prioritize secure coding practices to prevent similar issues in the future.