FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

PuTTY -- Four security holes in versions before 0.63

Affected packages
putty < 0.63

Details

VuXML ID 4b448a96-ff73-11e2-b28d-080027ef73ec
Discovery 2013-07-08
Entry 2013-08-07

Simon Tatham reports:

This [0.63] release fixes multiple security holes in previous versions of PuTTY, which can allow an SSH-2 server to make PuTTY overrun or underrun buffers and crash. [...]

These vulnerabilities can be triggered before host key verification, which means that you are not even safe if you trust the server you think you're connecting to, since it could be spoofed over the network and the host key check would not detect this before the attack could take place.

Additionally, when PuTTY authenticated with a user's private key, the private key or information equivalent to it was accidentally kept in PuTTY's memory for the rest of its run, where it could be retrieved by other processes reading PuTTY's memory, or written out to swap files or crash dumps. This release fixes that as well.

References

CVE Name CVE-2013-4206
CVE Name CVE-2013-4207
CVE Name CVE-2013-4208
CVE Name CVE-2013-4852
Message E1V6lUs-0007kP-40@atreus.tartarus.org
URL http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html
URL http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-bignum-division-by-zero.html
URL http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-modmul.html
URL http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-signature-stringlen.html