Information disclosure in PuTTY - CVE-2013-4208
Published: August 20, 2013 / Updated: August 10, 2020
Vulnerability identifier: #VU42657
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-4208
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The rsa_verify function in PuTTY before 0.63 (1) does not clear sensitive process memory after use and (2) does not free certain structures containing sensitive process memory, which might allow local users to discover private RSA and DSA keys.
Affected software
PuTTY
Gentoo Linux
Fedora
filezilla
Gentoo Linux
Fedora
filezilla
How to mitigate CVE-2013-4208
Install update from vendor's website.
filezilla - update to 3.7.3-1.el6
External References
- http://lists.opensuse.org/opensuse-updates/2013-08/msg00035.html
- http://secunia.com/advisories/54379
- http://secunia.com/advisories/54533
- http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html
- http://www.debian.org/security/2013/dsa-2736
- http://www.openwall.com/lists/oss-security/2013/08/06/11