PuTTY - Memory-Corrupting Integer Overflow in ECH Control Sequence Handling
Summary
DSA-3409-1: putty - security update. Affects putty versions < 0.62-9+deb7u3. Fixed in 0.62-9+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PuTTY is a popular open-source terminal emulator, serial console, and network file transfer application. It is widely used for secure remote access to Unix-based systems. PuTTY provides a user-friendly interface and supports various network protocols, including SSH, Telnet, and Rlogin. This vulnerability affects PuTTY's terminal emulator component, specifically in the handling of the ECH (erase characters) control sequence.
Vulnerability Detail
A memory-corrupting integer overflow vulnerability has been discovered in PuTTY's terminal emulator. By exploiting this flaw, a remote attacker can trigger a denial of service (DoS) condition or potentially execute arbitrary code on the target system. The vulnerability originates from improper handling of the ECH control sequence, leading to a memory corruption issue. An attacker can exploit this vulnerability by sending specially crafted input to a vulnerable PuTTY instance.
How To Fix
Minimum fixed version
0.62-9+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade puttyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is recommended to apply the available patch or upgrade to the fixed version as soon as possible.
Conclusion
PuTTY's terminal emulator component is vulnerable to a memory-corrupting integer overflow in the handling of the ECH control sequence. This vulnerability can be exploited by a remote attacker to cause a denial of service or potentially execute arbitrary code. To mitigate the risk, it is crucial to upgrade to the patched version or apply the available fix. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for putty →
FAQ
PuTTY is an open-source terminal emulator and network file transfer application used for secure remote access to Unix-based systems.
This vulnerability can be exploited by a remote attacker to cause a denial of service (DoS) or potentially execute arbitrary code on the target system.
To fix this vulnerability, upgrade your PuTTY installation to the patched version provided by the PuTTY project or the official Debian repositories.
No, only specific versions of PuTTY are affected. Refer to the vulnerability details for the impacted versions and the corresponding fixed versions.
No specific workaround has been provided for this vulnerability. It is recommended to apply the available patch or upgrade to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for putty.
