FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

PuTTY -- integer overflow permits memory overwrite by forwarded ssh-agent connections

Affected packages
putty < 0.68

Details

VuXML ID 9b973e97-0a99-11e7-ace7-080027ef73ec
Discovery 2017-01-29
Entry 2017-03-16

Simon G. Tatham reports:

Many versions of PuTTY prior to 0.68 have a heap-corrupting integer overflow bug in the ssh_agent_channel_data function which processes messages sent by remote SSH clients to a forwarded agent connection. [...]

This bug is only exploitable at all if you have enabled SSH agent forwarding, which is turned off by default. Moreover, an attacker able to exploit this bug would have to have already be able to connect to the Unix-domain socket representing the forwarded agent connection. Since any attacker with that capability would necessarily already be able to generate signatures with your agent's stored private keys, you should in normal circumstances be defended against this vulnerability by the same precautions you and your operating system were already taking to prevent untrusted people from accessing your SSH agent.

References

CVE Name CVE-2017-6542
URL http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-fwd-overflow.html