Integer overflow in the terminal emulator in PuTTY before 0.66 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via an ECH (erase characters) escape sequence with a large parameter value, which triggers a buffer underflow.

The remote host is affected by the vulnerability described in GLSA-201606-01 (PuTTY: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PuTTY. Please review       the CVE identifiers referenced below for details.
  Impact :

    Stack-based buffer overflow in the SCP command-line utility allows       remote servers to execute arbitrary code or cause a denial of service       condition via a crafted SCP-SINK file-size response to an SCP download       request.
  Workaround :

    There is no known workaround at this time.

This is new version of putty. ---- This is an update fixing integer overflow and buffer underrun in erase characters (ECH) handling.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A memory-corrupting integer overflow in the handling of the ECH (erase characters) control sequence was discovered in PuTTY's terminal emulator. A remote attacker can take advantage of this flaw to mount a denial of service or potentially to execute arbitrary code.

It was discovered that PuTTY's terminal emulator did not properly validate the parameter to the ECH (erase characters) control sequence, allowing a denial of service and possibly remote code execution.

For the oldoldstable distribution (squeeze), this problem has been fixed in version 0.60+2010-02-20-1+squeeze4.

For the oldstable (wheezy) and stable (jessie) distributions, this problem will be fixed soon.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

PuTTY was updated to 0.66 to fix security issues and bugs.

The following vulnerabilities were fixed :

  - CVE-2015-5309: Malicious ECH control sequences could     have caused an integer overflow, buffer underrun in     terminal emulator bnc#954191

Also contains all bug fixes up to the 0.66 release.

Ben Harris reports :

Versions of PuTTY and pterm between 0.54 and 0.65 inclusive have a potentially memory-corrupting integer overflow in the handling of the ECH (erase characters) control sequence in the terminal emulator.

To exploit a vulnerability in the terminal emulator, an attacker must be able to insert a carefully crafted escape sequence into the terminal stream. For a PuTTY SSH session, this must be before encryption, so the attacker likely needs access to the server you're connecting to. For instance, an attacker on a multi-user machine that you connect to could trick you into running cat on a file they control containing a malicious escape sequence. (Unix write(1) is not a vector for this, if implemented correctly.)

Only PuTTY, PuTTYtel, and pterm are affected; other PuTTY tools do not include the terminal emulator, so cannot be exploited this way.

ID	Name	Product	Family	Severity
91478	GLSA-201606-01 : PuTTY: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
89247	Fedora 22 : putty-0.66-1.fc22 (2015-5ad4a1f151)	Nessus	Fedora Local Security Checks	medium
89220	Fedora 23 : putty-0.66-1.fc23 (2015-3d17682c15)	Nessus	Fedora Local Security Checks	medium
87163	Debian DSA-3409-1 : putty - security update	Nessus	Debian Local Security Checks	medium
87068	Debian DLA-347-1 : putty security update	Nessus	Debian Local Security Checks	medium
86924	openSUSE Security Update : putty (openSUSE-2015-766)	Nessus	SuSE Local Security Checks	medium
86805	FreeBSD : PuTTY -- memory corruption in terminal emulator's erase character handling (0cb0afd9-86b8-11e5-bf60-080027ef73ec)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2015-5309

critical

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium