Heap-based buffer overflow in PuTTY - CVE-2017-6542

Vulnerability identifier: #VU6919

CSH Severity: Medium

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-6542

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary code or cause DoS condition on the target system.

The weakness exists due to heap-based buffer overflow bug in the ssh_agent_channel_data function of PuTTY. A remote attacker can send an agent protocol message containing large length value, connect to the Unix-domain socket representing the forwarded agent connection, trigger memory corruption and execute arbitrary code with privileges o the current user or cause the system to crash.

Successful exploitation of the vulnerability may result in system compromise.

PuTTY
Gentoo Linux
Fedora
putty (Alpine package)
putty

Update to version 0.68 or later.

putty (Alpine package) - update to 0.68-r0
putty - addressed in versions 0.70-1.el6, 0.70-1.fc25

• Exploit #1228 - PuTTY < 0.68 - 'ssh_agent_channel_data' Integer Overflow Heap Corruption (March 18, 2020)

• https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-fwd-overflow.html

• Remote code execution in PuTTY
• Gentoo update for PuTTy
• Gentoo update for PuTTY
• Heap-based buffer overflow in putty (Alpine package)
• Fedora 25 update for putty
• Fedora EPEL 6 update for putty