Main Vulnerability Database SB2019032122

SB2019032122 - Multiple vulnerabilities in PuTTY

Published: March 21, 2019 Updated: July 17, 2020

Security Bulletin ID SB2019032122

Severity

High

Patch available

YES

Number of vulnerabilities 3

Exploitation vector Remote access

Highest impact Code execution

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Key management errors (CVE-ID: CVE-2019-9894)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification.

2) Input validation error (CVE-ID: CVE-2019-9897)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71.

3) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2019-9898)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71.

Install update from vendor's website.