The rsa_verify function in PuTTY before 0.63 (1) does not clear sensitive process memory after use and (2) does not free certain structures containing sensitive process memory, which might allow local users to discover private RSA and DSA keys.

FileZilla was updated to version 3.7.3 to add various features, fix bugs and also security issues in the embedded putty ssh client.

Full changelog: https://filezilla-project.org/changelog.php

  - Noteworthy changes :

  - Apply a fix for a security vulnerability in PuTTY as     used in FileZilla to handle SFTP. See CVE-2013-4852 for     reference.

  - Merge further fixes from PuTTY to address CVE-2013-4206,     CVE-2013-4207, CVE-2013-4208

  - Version bump to 3.7.0.1

  - Fix issues with bundled gnutls

  - Update translations

  - Update to version 3.7.0. Changes since 3.6.0.2 :

  - Show total transfer speed as tooltip over the transfer     indicators

  - List supported protocols in tooltip of host field in     quickconnect bar

  - Use TLS instead of the deprecated term SSL

  - Reworded text when saving of passwords is disabled, do     not refer to kiosk mode

  - Improved usability of Update page in settings dialog

  - Improve SFTP performance

  - When navigating to the parent directory, highlight the     former child

  - When editing files, use high priority for the transfers

  - Add label to size conditions in filter conditions dialog     indicating that the unit is bytes

  - Ignore drag&drop operations where source and target are     identical and clarify the wording in some drop error     cases

  - Trim whitespace from the entered port numbers

  - Slightly darker color of inactive tabs

  - Ignore .. item in the file list context menus if     multiple items are selected

  - Display TLS version and key exchange algorithm in     certificate and encryption details dialog for FTP over     TLS connections.

  - Fix handling of remote paths containing double-quotes

  - Fix crash when opening local directories in Explorer if     the name contained characters not representable in the     locale's narrow-width character set.

  - Fix a memory leak in the host key verification dialog     for SFTP

  - Fix drag-scrolling in file lists with very low height

  - Don't attempt writing XML files upon loading them

  - Improve handling of legacy DDE file associations

  - Fix handling of HTTPS in the auto updater in case a     mirror redirects to HTTPS

  - Update to version 3.6.0.2. Changes since 3.5.3 :

  - 3.6.0.2 (2012-11-29)

  - Fix problems with stalling FTP over TLS uploads

  - MSW: Minor performance increase listing local files

  - 3.6.0.1 (2012-11-18)

  - Fix problems with TLS cipher selection, including a     bugfix for GnuTLS

  - Fix a crash on shutdown

  - Add log message for servers not using UTF-8

  - Small performance and memory optimizations getting file     types

  - Improve formatting of transfer speeds

  - 3.6.0 (2012-11-10)

  - Fix a crash introduced since 3.5.3

  - IPv6-only hosts should no longer cause a crash in the     network configuration wizard

The WinSCP program installed on the remote host is a version prior to 5.1.7. It therefore contains code from PuTTY that is affected by the following vulnerabilities related to PuTTY :

  - An overflow error exists that allows heap corruption     when handling DSA signatures. (CVE-2013-4206)

  - A buffer overflow error exists related to modular     inverse calculation, non-coprime values, and DSA     signature verification. (CVE-2013-4207)

  - An error exists that allows disclosure of private key     material. (CVE-2013-4208)

Merge further fixes from PuTTY to address CVE-2013-4206, CVE-2013-4207, CVE-2013-4208

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201309-08 (FileZilla: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FileZilla. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to connect to a malicious server,       resulting in possible arbitrary code execution or a Denial of Service.
      Additionally, a local attacker could read sensitive memory, potentially       resulting in password disclosure.
  Workaround :

    There is no known workaround at this time.

This is an update that fixes several bugs, for details see upstream announcement:
http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html This is an update that fixes four CVEs: CVE-2013-4206 CVE-2013-4207 CVE-2013-4208 CVE-2013-4852

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This is an update that fixes many bugs, for details see upstream announcement:
http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html This is an update that fixes four CVEs: CVE-2013-4206 CVE-2013-4207 CVE-2013-4208 CVE-2013-4852

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of FileZilla Client on the remote host is a version prior to 3.7.3.  As such, it is affected by multiple vulnerabilities :

  - A buffer underrun vulnerability exists that occurs when     verifying a DSA signature when using SFTP.
    (CVE-2013-4206)

  - A remote buffer overflow vulnerability exists that is     triggered when processing a specially crafted DSA     signature when using SFTP. (CVE-2013-4207)

  - Multiple information disclosure vulnerabilities exist     due to improper cleaning of private keys used in SFTP     sessions. An attacker could exploit these issues by     tricking a user into connecting to a specially crafted     SFTP server. This can lead to code execution, denial of     service, and access to sensitive information like SFTP     login passwords, obsolete session keys, public-key pass     phrases, and the private halves of public keys.
    (CVE-2013-4208)

The remote host has an installation of PuTTY version 0.52 or greater but earlier than version 0.63.  As such, it is reportedly affected by the following vulnerabilities :

  - An overflow error exists in the function 'modmul' in     the file 'putty/sshbn.c' that could allow heap     corruption when handling DSA signatures. (CVE-2013-4206)

  - A buffer overflow error exists related to modular     inverse calculation, non-coprime values and DSA     signature verification. (CVE-2013-4207)

  - An error exists in the file 'putty/sshdss.c' that could     allow disclosure of private key material.
    (CVE-2013-4208)

  - Multiple overflow errors exist in the files 'sshrsa.c'     and 'sshdss.c'. (CVE-2013-4852)

Several vulnerabilities where discovered in PuTTY, a Telnet/SSH client for X. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2013-4206     Mark Wooding discovered a heap-corrupting buffer     underrun bug in the modmul function which performs     modular multiplication. As the modmul function is called     during validation of any DSA signature received by     PuTTY, including during the initial key exchange phase,     a malicious server could exploit this vulnerability     before the client has received and verified a host key     signature. An attack to this vulnerability can thus be     performed by a man-in-the-middle between the SSH client     and server, and the normal host key protections against     man-in-the-middle attacks are bypassed.

  - CVE-2013-4207     It was discovered that non-coprime values in DSA     signatures can cause a buffer overflow in the     calculation code of modular inverses when verifying a     DSA signature. Such a signature is invalid. This bug     however applies to any DSA signature received by PuTTY,     including during the initial key exchange phase and thus     it can be exploited by a malicious server before the     client has received and verified a host key signature.

  - CVE-2013-4208     It was discovered that private keys were left in memory     after being used by PuTTY tools.

  - CVE-2013-4852     Gergely Eberhardt from SEARCH-LAB Ltd. discovered that     PuTTY is vulnerable to an integer overflow leading to     heap overflow during the SSH handshake before     authentication due to improper bounds checking of the     length parameter received from the SSH server. A remote     attacker could use this vulnerability to mount a local     denial of service attack by crashing the putty client.

Additionally this update backports some general proactive potentially security-relevant tightening from upstream.

The remote host is using a vulnerable version of PuTTY or of a PuTTY-based software (eg. PSCP or WinSCP). PuTTY is a Telnet/SSH client built for Linux and UNIX variants as well as Microsoft Windows operating systems. Reportedly PuTTY is affected by a buffer overflow (CVE-2013-4207) that could lead to remote code execution, a buffer underflow (CVE-2013-4206) that can corrupt the heap or cause a denial of service condition, and multiple information disclosure vulnerabilities due to its failure to properly clean the private keys typed by the user from memory during authentication.  

Simon Tatham reports :

This [0.63] release fixes multiple security holes in previous versions of PuTTY, which can allow an SSH-2 server to make PuTTY overrun or underrun buffers and crash. [...]

These vulnerabilities can be triggered before host key verification, which means that you are not even safe if you trust the server you think you're connecting to, since it could be spoofed over the network and the host key check would not detect this before the attack could take place.

Additionally, when PuTTY authenticated with a user's private key, the private key or information equivalent to it was accidentally kept in PuTTY's memory for the rest of its run, where it could be retrieved by other processes reading PuTTY's memory, or written out to swap files or crash dumps. This release fixes that as well.

ID	Name	Product	Family	Severity
75120	openSUSE Security Update : filezilla (openSUSE-SU-2013:1347-1)	Nessus	SuSE Local Security Checks	medium
72389	WinSCP < 5.1.7 Multiple Vulnerabilities	Nessus	Windows	medium
70204	Fedora 18 : filezilla-3.7.3-1.fc18 (2013-14794)	Nessus	Fedora Local Security Checks	medium
69899	GLSA-201309-08 : FileZilla: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
69411	Fedora 18 : putty-0.63-1.fc18 (2013-14676)	Nessus	Fedora Local Security Checks	medium
69410	Fedora 19 : putty-0.63-1.fc19 (2013-14656)	Nessus	Fedora Local Security Checks	medium
69392	Fedora 19 : filezilla-3.7.3-1.fc19 (2013-14706)	Nessus	Fedora Local Security Checks	medium
69494	FileZilla Client < 3.7.3 Multiple Vulnerabilities	Nessus	Windows	medium
69318	PuTTY 0.52 to 0.62 Multiple Vulnerabilities	Nessus	Windows	medium
69313	Debian DSA-2736-1 : putty - several vulnerabilities	Nessus	Debian Local Security Checks	medium
6987	PuTTY < 0.63 Multiple Vulnerabilities	Nessus Network Monitor	SSH	medium
69250	FreeBSD : PuTTY -- Four security holes in versions before 0.63 (4b448a96-ff73-11e2-b28d-080027ef73ec)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2013-4208

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium