Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows remote servers to cause a denial of service (stack memory corruption) or execute arbitrary code via a crafted SCP-SINK file-size response to an SCP download request.

The remote host has a version of PuTTY installed that is prior to 0.67. It is, therefore, affected by a stack-based buffer overflow related to handling SCP-SINK file-size responses that could allow arbitrary code execution.

The remote host is affected by the vulnerability described in GLSA-201606-01 (PuTTY: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PuTTY. Please review       the CVE identifiers referenced below for details.
  Impact :

    Stack-based buffer overflow in the SCP command-line utility allows       remote servers to execute arbitrary code or cause a denial of service       condition via a crafted SCP-SINK file-size response to an SCP download       request.
  Workaround :

    There is no known workaround at this time.

This update to putty 0.67 fixes the following vulnerability :

  - CVE-2016-2563: old-style scp downloads may allow remote     code execution (boo#981407)

Simon G. Tatham reports :

Many versions of PSCP prior to 0.67 have a stack corruption vulnerability in their treatment of the 'sink' direction (i.e.
downloading from server to client) of the old-style SCP protocol.

In order for this vulnerability to be exploited, the user must connect to a malicious server and attempt to download any file.[...] you can work around it in a vulnerable PSCP by using the -sftp option to force the use of the newer SFTP protocol, provided your server supports that protocol.

ID	Name	Product	Family	Severity
105154	PuTTY < 0.67 PSCP Server Header Handling Stack Buffer Overflow	Nessus	Windows	critical
91478	GLSA-201606-01 : PuTTY: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
91412	openSUSE Security Update : putty (openSUSE-2016-667)	Nessus	SuSE Local Security Checks	critical
89727	FreeBSD : PuTTY - old-style scp downloads may allow remote code execution (7f0fbb30-e462-11e5-a3f3-080027ef73ec)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2016-2563

critical

Tenable Plugins

critical

critical

critical

critical