CVE-2003-0213
ctrlpacket.c in PoPToP PPTP server before 1.1.4-b3 allows remote attackers to cause a denial of...
ctrlpacket.c in PoPToP PPTP server before 1.1.4-b3 allows remote attackers to cause a denial of service via a length field of 0 or 1, which causes a negative value to be fed into a read operation, leading to a buffer overflow.
Exploit likelihood
What each source reports
NVD Score used
ctrlpacket.c in PoPToP PPTP server before 1.1.4-b3 allows remote attackers to cause a denial of service via a length field of 0 or 1, which causes a negative value to be fed into a read operation, leading to a buffer overflow.
- Record
CVE-2003-0213- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
ctrlpacket.c in PoPToP PPTP server before 1.1.4-b3 allows remote attackers to cause a denial of service via a length field of 0 or 1, which causes a negative value to be fed into a read operation, leading to a buffer overflow.
- Record
CVE-2003-0213- Updated
- 2026-11-02
EUVDEUVD-2003-0208 No score
ctrlpacket.c in PoPToP PPTP server before 1.1.4-b3 allows remote attackers to cause a denial of service via a length field of 0 or 1, which causes a negative value to be fed into a read operation, leading to a buffer overflow.
- Record
EUVD-2003-0208- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-84m7-68fc-v7c9 No score
ctrlpacket.c in PoPToP PPTP server before 1.1.4-b3 allows remote attackers to cause a denial of...
ctrlpacket.c in PoPToP PPTP server before 1.1.4-b3 allows remote attackers to cause a denial of service via a length field of 0 or 1, which causes a negative value to be fed into a read operation, leading to a buffer overflow.
- Record
GHSA-84m7-68fc-v7c9- Updated
- 2026-11-02
OSV No score
ctrlpacket.c in PoPToP PPTP server before 1.1.4-b3 allows remote attackers to cause a denial of service via a length field of 0 or 1, which causes a negative value to be fed into a read operation, leading to a buffer overflow.
- Record
CVE-2003-0213- Updated
- 2026-11-02
OSVDEBIAN-CVE-2003-0213 No score
ctrlpacket.c in PoPToP PPTP server before 1.1.4-b3 allows remote attackers to cause a denial of service via a length field of 0 or 1, which causes a negative value to be fed into a read operation, leading to a buffer overflow.
- Record
DEBIAN-CVE-2003-0213- Updated
- 2026-11-02
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | PoPToP PPTP 1.1.4-b3 - Remote Command Execution | 2003-04-18 |
| Exploit-DB | PoPToP - Negative Read Overflow (Metasploit) | 2010-11-23 |
| Exploit-DB | PoPToP PPTP 1.1.4-b3 - 'poptop-sane.c' Remote Command Execution | 2003-04-25 |
| Exploit-DB | PoPToP PPTP 1.0/1.1.x - Negative 'read()' Argument Remote Buffer Overflow | 2003-04-09 |
| Exploit-DB | PoPToP < 1.1.3-b3/1.1.3-20030409 - Negative Read Overflow (Metasploit) | 2003-04-09 |
| Metasploit | Poptop Negative Read Overflow | 2003-04-09 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2003-0213 is a high vulnerability (CVSS 7.5) in Poptop Pptp Server, published April 26, 2003. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 70.9%, the 99th percentile. Fixed in pptpd 1.1.4-0.b3.2.