Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.
Arbitrary Code Execution in PuTTY for Windows
A vulnerability in the Telnet/Secure Shell (SSH) program PuTTY could result in the remote execution of arbitrary code on the vulnerable system.
Ken Pfeil
October 27, 2004
1 Min Read
Reported October 28, 2004,by iDEFENSE
VERSIONS AFFECTED
DESCRIPTION
A vulnerability in the Telnet/Secure Shell (SSH) program PuTTY couldresult in the remote execution of arbitrary code on the vulnerable system. Thisvulnerability is a result of insufficient bounds checking on SSH2_MSG_DEBUGpackets. The stringlen parameter obtains a user-supplied value by reading in aninteger from an offset in the packet data. Signedness problems cause the stringlenvalue to be incorrectly checked.
VENDOR RESPONSE
The author, Simon Tatham, has released PuTTY 0.56to address this vulnerability.
CREDIT
Discovered by iDEFENSE.
About the Author
You May Also Like
