Detections
Analytics
Debian dla-3839 : pterm - security update
medium Nessus Plugin ID 200783
Language:
Synopsis
The remote Debian host is missing a security-related update.Description
The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3839 advisory.- ------------------------------------------------------------------------- Debian LTS Advisory DLA-3839-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucaris June 20, 2024 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : putty Version : 0.74-1+deb11u1~deb10u2 CVE ID : CVE-2024-31497
A biased ECDSA nonce generation allowed an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures. In other words, an adversary may already have enough signature information to compromise a victim's private key, even if there is no further use of vulnerable PuTTY versions.
This allowed an attacker to (for instance) log in to any servers the victim uses that key for.
To obtain these signatures, an attacker need only briefly compromise any server the victim uses the key to authenticate to.
Therefore, if you have any NIST-P521 ECDSA key, we strongly recommend you to replace it with a freshly new created with a fixed version of putty. Then, to revoke the old public key and remove it from any machine where you use it to login into, so that a signature from the compromised key has no value any more.
The only affected key type is 521-bit ECDSA. That is, a key that appears in Windows PuTTYgen with ecdsa-sha2-nistp521 at the start of the 'Key fingerprint' box, or is described as 'NIST p521', or has an id starting ecdsa-sha2-nistp521 in the SSH protocol or the key file.
Other sizes of ECDSA, and other key algorithms, are unaffected.
In particular, Ed25519 is not affected.
For Debian 10 buster, this problem has been fixed in version 0.74-1+deb11u1~deb10u2.
We recommend that you upgrade your putty packages.
For the detailed security status of putty please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/putty
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS
Tenable has extracted the preceding description block directly from the Debian security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Upgrade the pterm packages.See Also
https://security-tracker.debian.org/tracker/source-package/putty
Plugin Details
Severity: Medium
ID: 200783
File Name: debian_DLA-3839.nasl
Version: 1.1
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 6/20/2024
Updated: 6/20/2024
Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.1
CVSS v2
Risk Factor: Medium
Base Score: 5.4
Temporal Score: 4.2
Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:N
CVSS Score Source: CVE-2024-31497
CVSS v3
Risk Factor: Medium
Base Score: 5.9
Temporal Score: 5.3
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:putty-tools, cpe:/o:debian:debian_linux:10.0, p-cpe:/a:debian:debian_linux:putty, p-cpe:/a:debian:debian_linux:pterm, p-cpe:/a:debian:debian_linux:putty-doc
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/20/2024
Vulnerability Publication Date: 4/15/2024
Reference Information
CVE: CVE-2024-31497
IAVA: 2024-A-0243