FreeBSD : PuTTY 0.72 -- buffer overflow in SSH-1 and integer overflow in SSH client (5914705c-ab03-11e9-a4f9-080027ac955c)

high Nessus Plugin ID 126842

Language:

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

Simon Tatham reports :

Vulnerabilities fixed in this release include :

- A malicious SSH-1 server could trigger a buffer overrun by sending extremely short RSA keys, or certain bad packet length fields. Either of these could happen before host key verification, so even if you trust the server you *intended* to connect to, you would still be at risk.

(However, the SSH-1 protocol is obsolete, and recent versions of PuTTY do not try it by default, so you are only at risk if you work with old servers and have explicitly configured SSH-1.)

- If a malicious process found a way to impersonate Pageant, then it could cause an integer overflow in any of the SSH client tools (PuTTY, Plink, PSCP, PSFTP) which accessed the malicious Pageant.

Other security-related bug fixes include :

- The 'trust sigil' system introduced in PuTTY 0.71 to protect against server spoofing attacks had multiple bugs. Trust sigils were not turned off after login in the SSH-1 and Rlogin protocols, and not turned back on if you used the Restart Session command. Both are now fixed.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 126842

File Name: freebsd_pkg_5914705cab0311e9a4f9080027ac955c.nasl

Version: 1.1

Type: local

Family: FreeBSD Local Security Checks

Published: 7/22/2019

Updated: 7/22/2019

Supported Sensors: Nessus

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:putty, p-cpe:/a:freebsd:freebsd:putty-gtk2, p-cpe:/a:freebsd:freebsd:putty-nogtk, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 7/20/2019

Vulnerability Publication Date: 7/14/2019

Detections

Analytics