Description
Roaring Penguin pppoe (rp-ppoe), if installed or configured to run setuid root contrary to its design, allows local users to overwrite arbitrary files. NOTE: the developer has publicly disputed the claim that this is a vulnerability because pppoe "is NOT designed to run setuid-root." Therefore this identifier applies *only* to those configurations and installations under which pppoe is run setuid root despite the developer's warnings.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rp-pppoe | 3.5-4 | — |
| Debian 13 | rp-pppoe | 3.5-4 | — |
| Debian 12 | rp-pppoe | 3.5-4 | — |
| Debian 3.0 | rp-pppoe | 3.3-1.2 | DSA-557-1 |
Advisories 1
- DSA-557-1 pppoe - missing privilegue dropping Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20041208 Re: MDKSA-2004:145 - Updated rp-pppoe packages fix vulnerability mailing-list
- 11315 vdb-entry
- pppoe-file-overwrite(17576) vdb-entry
- DSA-557 vendor-advisory
- FLSA:152794 vendor-advisory
- MDKSA-2004:145 vendor-advisory