CVE-2004-0649 describes a critical buffer overflow vulnerability in the write_packet function of control.c within l2tpd, affecting various l2tpd and Gentoo Linux distributions. This flaw allows unauthenticated remote attackers to execute arbitrary code with maximum impact on confidentiality, integrity, and availability, as indicated by its CVSS score of 10.0. Despite its age and high severity, there is no evidence of active exploitation, and public exploit code (Metasploit, Nuclei, ExploitDB) is unavailable. However, the vulnerability has garnered significant community discussion, with 10 mentions, suggesting continued awareness.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
0.62CPE matchmatch criteria | cpe:2.3:a:l2tpd:l2tpd:0.62:*:*:*:*:*:*:* | ||
0.63CPE matchmatch criteria | cpe:2.3:a:l2tpd:l2tpd:0.63:*:*:*:*:*:*:* | ||
0.64CPE matchmatch criteria | cpe:2.3:a:l2tpd:l2tpd:0.64:*:*:*:*:*:*:* | ||
0.65CPE matchmatch criteria | cpe:2.3:a:l2tpd:l2tpd:0.65:*:*:*:*:*:*:* | ||
0.66CPE matchmatch criteria | cpe:2.3:a:l2tpd:l2tpd:0.66:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.