Multiple buffer overflows in the PPPoE daemon (PPPoEd) in QNX RTP 6.1 allow remote attackers to execute arbitrary code via a long argument to the (1) -F (2) name (3) en (4) upscript (5) downscript (6) retries (7) timeout (8) scriptdetach (9) noscript (10) nodetach (11) remote_mac or (12) local_mac flags.