The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message and leveraging the ability to connect to the Unix-domain socket representing the forwarded agent connection, which trigger a buffer overflow.

This is an update fixing CVE-2017-6542.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201706-09 (FileZilla: Buffer overflow)

    FileZilla is affected by the same vulnerability as reported in &ldquo;GLSA       201703-03&rdquo; because the package included a vulnerable copy of PuTTY.
      Please read the GLSA for PuTTY referenced below for details.
  Impact :

    A remote attacker, utilizing the SSH agent forwarding of an SSH server,       could execute arbitrary code with the privileges of the user running       FileZilla or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update to putty 0.68 fixes the following security issue :

  - CVE-2017-6542: If SSH agent forwarding is enabled, local     attackers that are also able to connect to the UNIX     domain socket could have overwritten heap data     (boo#1029256)

The remote host is affected by the vulnerability described in GLSA-201703-03 (PuTTY: Buffer overflow)

    A heap-corrupting buffer overflow bug in the ssh_agent_channel_data       function of PuTTY was found.
  Impact :

    A remote attacker, utilizing the SSH agent forwarding of an SSH server,       could execute arbitrary code with the privileges of the user running the       client or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Simon G. Tatham reports :

Many versions of PuTTY prior to 0.68 have a heap-corrupting integer overflow bug in the ssh_agent_channel_data function which processes messages sent by remote SSH clients to a forwarded agent connection.
[...]

This bug is only exploitable at all if you have enabled SSH agent forwarding, which is turned off by default. Moreover, an attacker able to exploit this bug would have to have already be able to connect to the Unix-domain socket representing the forwarded agent connection.
Since any attacker with that capability would necessarily already be able to generate signatures with your agent's stored private keys, you should in normal circumstances be defended against this vulnerability by the same precautions you and your operating system were already taking to prevent untrusted people from accessing your SSH agent.

ID	Name	Product	Family	Severity
101873	Fedora 25 : putty (2017-efdd962fee)	Nessus	Fedora Local Security Checks	critical
100652	GLSA-201706-09 : FileZilla: Buffer overflow	Nessus	Gentoo Local Security Checks	critical
97818	openSUSE Security Update : putty (openSUSE-2017-354)	Nessus	SuSE Local Security Checks	critical
97815	GLSA-201703-03 : PuTTY: Buffer overflow	Nessus	Gentoo Local Security Checks	critical
97789	FreeBSD : PuTTY -- integer overflow permits memory overwrite by forwarded ssh-agent connections (9b973e97-0a99-11e7-ace7-080027ef73ec)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2017-6542

critical

Tenable Plugins

critical

critical

critical

critical

critical