From 73e069adbd1bc77ff56c41495ed9b2e4361bb5e5 Mon Sep 17 00:00:00 2001 From: Matthias Andree Date: Mon, 9 Nov 2015 08:06:55 +0000 Subject: [PATCH] Record PuTTY vuln' CVE-2015-5309 (Erase char handling). --- security/vuxml/vuln.xml | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 8e387db91ac6..f6746c2013d0 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,46 @@ Notes: --> + + PuTTY -- memory corruption in terminal emulator's erase character handling + + + putty + 0.540.66 + + + + +

Ben Harris reports:

+
+

Versions of PuTTY and pterm between 0.54 and 0.65 inclusive have a + potentially memory-corrupting integer overflow in the handling of + the ECH (erase characters) control sequence in the terminal + emulator.

+

To exploit a vulnerability in the terminal emulator, an attacker + must be able to insert a carefully crafted escape sequence into the + terminal stream. For a PuTTY SSH session, this must be before + encryption, so the attacker likely needs access to the server you're + connecting to. For instance, an attacker on a multi-user machine + that you connect to could trick you into running cat on a file they + control containing a malicious escape sequence. (Unix write(1) is + not a vector for this, if implemented correctly.)

+

Only PuTTY, PuTTYtel, and pterm are affected; other PuTTY tools do + not include the terminal emulator, so cannot be exploited this + way.

+
+ + + + http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html + CVE-2015-5309 + + + 2015-11-06 + 2015-11-09 + + + OpenOffice 4.1.1 -- multiple vulnerabilities