Critical OpenBSD Vulnerability Lets Attackers Bypass PAP Authentication

Key Takeaways

• A critical, decades-old vulnerability in OpenBSD’s networking stack allows attackers to completely bypass PAP authentication.
• The flaw, present since 1999, affects the sppp(4) subsystem used for synchronous PPP links, including PPPoE.
• Attackers can exploit this logic error by sending zero-length credentials, gaining unauthorized access to network sessions.
• A patch was released on June 14, 2024, and organizations are urged to update their OpenBSD systems immediately.

A significant security vulnerability, resident in the OpenBSD operating system for over two decades, has been publicly disclosed. This flaw enables unauthorized individuals to circumvent the Password Authentication Protocol (PAP) entirely, granting them illicit access to network sessions.

The core of the problem lies within the sppp_pap_input() function, a component of OpenBSD’s sppp(4) subsystem, which is responsible for managing synchronous Point-to-Point Protocol (PPP) connections, often utilized in PPPoE (PPP over Ethernet) deployments.

During the standard PPP authentication process, PAP is designed to verify user credentials before a network session can be established. However, cybersecurity researchers discovered a fundamental flaw in this validation logic that has persisted since its original implementation in 1999.

Deep-Rooted Logic Error Leads to Authentication Bypass

The vulnerability stems from an improper handling of attacker-controlled length fields during the comparison of user credentials. The PAP credential validation mechanism employs the bcmp() function to compare provided usernames and passwords against stored values. Crucially, it directly trusts the length values embedded in the incoming PAP frame without adequate verification.

Specifically, the problematic code snippet initially appeared as:

if (name_len > AUTHMAXLEN ||
    passwd_len > AUTHMAXLEN ||
    bcmp(name, sp->hisauth.name, name_len) != 0 ||
    bcmp(passwd, sp->hisauth.secret, passwd_len) != 0) {
        /* authentication failed */
}

Because zero-length values for name_len and passwd_len successfully pass the initial upper-bound checks (> AUTHMAXLEN), the subsequent bcmp() comparisons are effectively bypassed. This allows OpenBSD to incorrectly accept authentication requests even when no valid credentials have been provided, leading to a complete authentication bypass.

Furthermore, a related issue arises from the same design flaw. If an attacker provides a length value that exceeds the actual size allocated for the stored credentials, the bcmp() function can read beyond its intended memory buffer. This results in a kernel heap overread, potentially exposing sensitive data from adjacent memory regions. This memory corruption became a more significant risk after a 2009 update replaced fixed-size buffers with dynamically allocated memory, increasing the potential for out-of-bounds access.

Exploitation Scenario and Impact

The vulnerability is accessible through the PPPoE data path and does not necessitate pre-existing valid credentials. An attacker can exploit this flaw by operating a malicious PPPoE server within the same broadcast domain, effectively impersonating a legitimate server.

A typical attack sequence unfolds as follows:

• The attacker successfully completes the PPPoE discovery and negotiation phases.
• A PAP request is sent with both username and password fields set to zero length.
• The vulnerable OpenBSD client accepts this invalid authentication request and establishes a connection.
• Consequently, all network traffic from the client is then routed through the attacker-controlled endpoint, allowing for potential interception or manipulation.

Proof-of-concept demonstrations have confirmed the real-world viability of this exploit, showcasing full session establishment, including IP address configuration and successful ICMP communication.

The vulnerable code originated from FreeBSD and traces its lineage back to a Cronyx Engineering implementation from the mid-1990s. Despite numerous updates to OpenBSD over the years, this critical flaw in the credential comparison logic remained unaddressed for approximately 27 years.

Patch and Mitigation

The corrective patch aligns the PAP handler with the more secure pattern already present in the Challenge-Handshake Authentication Protocol (CHAP) handler. It introduces explicit length pre-checks before any bcmp() call, ensuring that the provided lengths precisely match the expected credential lengths. The revised logic now includes:

if (name_len != strlen(sp->hisauth.name) ||
    passwd_len != strlen(sp->hisauth.secret) ||
    bcmp(name, sp->hisauth.name, name_len) != 0 ||
    bcmp(passwd, sp->hisauth.secret, passwd_len) != 0) {
        /* authentication failed */
}

According to a blog post by Argus Systems, the issue was responsibly disclosed on June 12, 2024, and a fix was promptly integrated within two days. The patch specifically adds stringent length validation checks to reject both zero-length and oversized inputs before the comparison process, thereby preventing the authentication bypass and potential memory overread.

What You Should Do

• Immediately apply the latest patches to all OpenBSD systems, especially those operating in environments that utilize PPPoE authentication.
• Review and audit network configurations to identify any OpenBSD instances that might be exposed to untrusted broadcast domains.
• Consider implementing stronger authentication protocols where feasible, such as CHAP, which is not affected by this particular vulnerability due to its more robust design.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.