FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-03-27 18:04:16 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
0cb0afd9-86b8-11e5-bf60-080027ef73ecPuTTY -- memory corruption in terminal emulator's erase character handling

Ben Harris reports:

Versions of PuTTY and pterm between 0.54 and 0.65 inclusive have a potentially memory-corrupting integer overflow in the handling of the ECH (erase characters) control sequence in the terminal emulator.

To exploit a vulnerability in the terminal emulator, an attacker must be able to insert a carefully crafted escape sequence into the terminal stream. For a PuTTY SSH session, this must be before encryption, so the attacker likely needs access to the server you're connecting to. For instance, an attacker on a multi-user machine that you connect to could trick you into running cat on a file they control containing a malicious escape sequence. (Unix write(1) is not a vector for this, if implemented correctly.)

Only PuTTY, PuTTYtel, and pterm are affected; other PuTTY tools do not include the terminal emulator, so cannot be exploited this way.


Discovery 2015-11-06
Entry 2015-11-09
putty
ge 0.54 lt 0.66

http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html
CVE-2015-5309
46e1ece5-48bd-11e9-9c40-080027ac955cPuTTY -- security fixes in new release

The PuTTY team reports:

New in 0.71:

  • Security fixes found by an EU-funded bug bounty programme:
  • + a remotely triggerable memory overwrite in RSA key exchange, which can occur before host key verification
  • + potential recycling of random numbers used in cryptography
  • + on Unix, remotely triggerable buffer overflow in any kind of server-to-client forwarding
  • + multiple denial-of-service attacks that can be triggered by writing to the terminal
  • Other security enhancements: major rewrite of the crypto code to remove cache and timing side channels.
  • User interface changes to protect against fake authentication prompts from a malicious server.

Discovery 2019-03-16
Entry 2019-03-17
putty
< 0.71

putty-gtk2
< 0.71

putty-nogtk
< 0.71

https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
7f0fbb30-e462-11e5-a3f3-080027ef73ecPuTTY - old-style scp downloads may allow remote code execution

Simon G. Tatham reports:

Many versions of PSCP prior to 0.67 have a stack corruption vulnerability in their treatment of the 'sink' direction (i.e. downloading from server to client) of the old-style SCP protocol.

In order for this vulnerability to be exploited, the user must connect to a malicious server and attempt to download any file.[...] you can work around it in a vulnerable PSCP by using the -sftp option to force the use of the newer SFTP protocol, provided your server supports that protocol.


Discovery 2016-02-26
Entry 2016-03-07
putty
< 0.67

http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-pscp-sink-sscanf.html
CVE-2016-2563
https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-2563
a413ed94-836e-11d9-a9e7-0001020eed82putty -- pscp/psftp heap corruption vulnerabilities

Simon Tatham reports:

This version fixes a security hole in previous versions of PuTTY, which can allow a malicious SFTP server to attack your client. If you use either PSCP or PSFTP, you should upgrade. Users of the main PuTTY program are not affected. (However, note that the server must have passed host key verification before this attack can be launched, so a man-in-the-middle shouldn't be able to attack you if you're careful.)


Discovery 2005-02-20
Entry 2005-02-20
Modified 2005-02-23
putty
< 0.57

12601
CVE-2005-0467
http://lists.tartarus.org/pipermail/putty-announce/2005/000012.html
http://marc.theaimsgroup.com/?l=bugtraq&m=110902510713763
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-readdir.html
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-string.html
6190c0cd-b945-11ea-9401-2dcf562daa69PuTTY -- Release 0.74 fixes two security vulnerabilities

Simon Tatham reports:

[Release 0.74] fixes the following security issues:

  • New configuration option to disable PuTTY's default policy of changing its host key algorithm preferences to prefer keys it already knows. (There is a theoretical information leak in this policy.) [CVE-2020-14002]
  • In some situations an SSH server could cause PuTTY to access freed mdmory by pretending to accept an SSH key and then refusing the actual signature. It can only happen if you're using an SSH agent.

Discovery 2020-06-27
Entry 2020-06-28
putty
< 0.74

putty-gtk2
< 0.74

putty-nogtk
< 0.74

https://lists.tartarus.org/pipermail/putty-announce/2020/000030.html
https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-dynamic-hostkey-info-leak.html
https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2-ausnutzung-eines-informationslecks-fuer-gezielte-mitm-angriffe-auf-ssh-clients/
CVE-2020-14002
https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-keylist-used-after-free.html
19518d22-2d05-11d9-8943-0050fc56d258putty -- buffer overflow vulnerability in ssh2 support

There is a bug in SSH2 support that allows a server to execute malicious code on a connecting PuTTY client. This attack can be performed before host key verification happens, so a different machine -- man in the middle attack -- could fake the machine you are connecting to.


Discovery 2004-10-26
Entry 2004-11-04
Modified 2005-01-19
putty
< 0.56

http://marc.theaimsgroup.com/?l=bugtraq&m=109890310929207
http://www.gentoo.org/security/en/glsa/glsa-200410-29.xml
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ssh2-debug.html
4b448a96-ff73-11e2-b28d-080027ef73ecPuTTY -- Four security holes in versions before 0.63

Simon Tatham reports:

This [0.63] release fixes multiple security holes in previous versions of PuTTY, which can allow an SSH-2 server to make PuTTY overrun or underrun buffers and crash. [...]

These vulnerabilities can be triggered before host key verification, which means that you are not even safe if you trust the server you think you're connecting to, since it could be spoofed over the network and the host key check would not detect this before the attack could take place.

Additionally, when PuTTY authenticated with a user's private key, the private key or information equivalent to it was accidentally kept in PuTTY's memory for the rest of its run, where it could be retrieved by other processes reading PuTTY's memory, or written out to swap files or crash dumps. This release fixes that as well.


Discovery 2013-07-08
Entry 2013-08-07
putty
< 0.63

CVE-2013-4206
CVE-2013-4207
CVE-2013-4208
CVE-2013-4852
http://lists.tartarus.org/pipermail/putty-announce/2013/000018.html
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-modmul.html
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-bignum-division-by-zero.html
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-signature-stringlen.html
92fc2e2b-c383-11e4-8ef7-080027ef73ecPuTTY -- fails to scrub private keys from memory after use

Simon Tatham reports:

When PuTTY has sensitive data in memory and has no further need for it, it should wipe the data out of its memory, in case malware later gains access to the PuTTY process or the memory is swapped out to disk or written into a crash dump file. An obvious example of this is the password typed during SSH login; other examples include obsolete session keys, public-key passphrases, and the private halves of public keys.

PuTTY 0.63 and earlier versions, after loading a private key from a disk file, mistakenly leak a memory buffer containing a copy of the private key, in the function ssh2_load_userkey. The companion function ssh2_save_userkey (only called by PuTTYgen) can also leak a copy, but only in the case where the file it tried to save to could not be created.


Discovery 2015-02-28
Entry 2015-03-05
putty
< 0.64

http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped-2.html
CVE-2015-2157
5914705c-ab03-11e9-a4f9-080027ac955cPuTTY 0.72 -- buffer overflow in SSH-1 and integer overflow in SSH client

Simon Tatham reports:

Vulnerabilities fixed in this release include:

  • A malicious SSH-1 server could trigger a buffer overrun by sending extremely short RSA keys, or certain bad packet length fields. Either of these could happen before host key verification, so even if you trust the server you *intended* to connect to, you would still be at risk.

    (However, the SSH-1 protocol is obsolete, and recent versions of PuTTY do not try it by default, so you are only at risk if you work with old servers and have explicitly configured SSH-1.)
  • If a malicious process found a way to impersonate Pageant, then it could cause an integer overflow in any of the SSH client tools (PuTTY, Plink, PSCP, PSFTP) which accessed the malicious Pageant.

Other security-related bug fixes include:

  • The 'trust sigil' system introduced in PuTTY 0.71 to protect against server spoofing attacks had multiple bugs. Trust sigils were not turned off after login in the SSH-1 and Rlogin protocols, and not turned back on if you used the Restart Session command. Both are now fixed.

Discovery 2019-07-14
Entry 2019-07-20
putty
< 0.72

putty-gtk2
< 0.72

putty-nogtk
< 0.72

https://lists.tartarus.org/pipermail/putty-announce/2019/000028.html
9b973e97-0a99-11e7-ace7-080027ef73ecPuTTY -- integer overflow permits memory overwrite by forwarded ssh-agent connections

Simon G. Tatham reports:

Many versions of PuTTY prior to 0.68 have a heap-corrupting integer overflow bug in the ssh_agent_channel_data function which processes messages sent by remote SSH clients to a forwarded agent connection. [...]

This bug is only exploitable at all if you have enabled SSH agent forwarding, which is turned off by default. Moreover, an attacker able to exploit this bug would have to have already be able to connect to the Unix-domain socket representing the forwarded agent connection. Since any attacker with that capability would necessarily already be able to generate signatures with your agent's stored private keys, you should in normal circumstances be defended against this vulnerability by the same precautions you and your operating system were already taking to prevent untrusted people from accessing your SSH agent.


Discovery 2017-01-29
Entry 2017-03-16
putty
< 0.68

http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-fwd-overflow.html
CVE-2017-6542