PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1_MSG_DISCONNECT message.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory     locations via an SSH1_MSG_DISCONNECT message. (CVE-2019-17069)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3794 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3794-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     April 25, 2024                                https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : putty     Version        : 0.74-1+deb11u1~deb10u1     CVE ID         : CVE-2019-17069 CVE-2020-14002 CVE-2021-36367 CVE-2023-48795     Debian Bug     : 990901

    Putty, a Telnet/SSH client for X, was vulnerable.

    CVE-2019-17069

      PuTTY allowed remote SSH-1 servers to cause a denial       of service by accessing freed memory locations via an       SSH1_MSG_DISCONNECT message.

    CVE-2020-14002

      PuTTY had an Observable Discrepancy leading to an       information leak in the algorithm negotiation.
      This allowed man-in-the-middle attackers to target       initial connection attempts (where no host key for the       server has been cached by the client).

    CVE-2021-36367

      PuTTY proceeded with establishing an SSH session even       if it has never sent a substantive authentication response.
      This made it easier for an attacker-controlled SSH server       to present a later spoofed authentication prompt (that the       attacker can use to capture credential data, and use that       data for purposes that are undesired by the client user).

    CVE-2023-48795

       PuTTY was vulnerable to Terrapin attack.  The SSH transport        protocol with certain OpenSSH extensions, allowed remote attackers        to bypass integrity checks such that some packets are omitted (from        the extension negotiation message), and a client and server may        consequently end up with a connection for which some security        features have been downgraded or disabled. This occurs because the        SSH Binary Packet Protocol (BPP), implemented by these extensions,        mishandles the handshake phase and mishandles use of sequence        numbers. For example, there is an effective attack against SSH's        use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The        bypass occurs in chacha20-poly1305 and (if CBC is used)        the -etm MAC algorithms.

    For Debian 10 buster, this problem has been fixed in version     0.74-1+deb11u1~deb10u1.

    We recommend that you upgrade your putty packages.

    For the detailed security status of putty please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/putty

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - PuTTY before 0.73 mishandles the "bracketed paste mode" protection mechanism, which may allow a session to
    be affected by malicious clipboard content. (CVE-2019-17068)

  - PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory
    locations via an SSH1_MSG_DISCONNECT message. (CVE-2019-17069)

This update for putty to version 0.73 fixes the following issues :

  - CVE-2019-17068: Fixed the insufficient handling of     terminal escape sequences, that should delimit the     pasted data in bracketed paste mode (boo#1152753).

  - CVE-2019-17069: Fixed a possible information leak caused     by SSH-1 disconnection messages (boo#1152753).

This update for putty to version 0.73 fixes the following issues :

Security issues fixed :

  - CVE-2019-17068: Fixed the insufficient handling of     terminal escape sequences, that should delimit the     pasted data in bracketed paste mode (boo#1152753).

  - CVE-2019-17069: Fixed a possible information leak caused     by SSH-1 disconnection messages (boo#1152753).

ID	Name	Product	Family	Severity
250793	Linux Distros Unpatched Vulnerability : CVE-2019-17069	Nessus	Misc.	high
193899	Debian dla-3794 : pterm - security update	Nessus	Debian Local Security Checks	critical
406595	Alpine: multiple putty packages: security update to 0.73-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
406595	Alpine: multiple putty packages: security update to 0.73-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400474	Alpine: multiple putty packages: security update to 0.71-r1 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400474	Alpine: multiple putty packages: security update to 0.71-r1 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
129705	openSUSE Security Update : putty (openSUSE-2019-2277)	Nessus	SuSE Local Security Checks	high
129704	openSUSE Security Update : putty (openSUSE-2019-2276)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2019-17069

high

Tenable Plugins

high

critical

high

high

high

high

high

high