CVE-2013-4852

2013-08-1923:55:00

CWE-189

[email protected]

web.nvd.nist.gov

putty

winscp

ssh

remote servers

denial of service

arbitrary code execution

rsa key signature

heap-based buffer overflow

7.6 High

AI Score

Confidence

Low

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.027 Low

EPSS

Percentile

90.5%

JSON

Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the SSH handshake, which triggers a heap-based buffer overflow.

CPENameOperatorVersion
winscp:winscpwinscpeq5.1.1
winscp:winscpwinscpeq5.0.6
winscp:winscpwinscpeq4.3.2
winscp:winscpwinscpeq5.0.9
winscp:winscpwinscpeq5.0.7
winscp:winscpwinscpeq3.8_beta
winscp:winscpwinscpeq5.0.5
winscp:winscpwinscpeq5.1.4
winscp:winscpwinscpeq5.1.2
winscp:winscpwinscpeq4.2.7

CPE	Name	Operator	Version
winscp:winscp	winscp	eq	5.1.1
winscp:winscp	winscp	eq	5.0.6
winscp:winscp	winscp	eq	4.3.2
winscp:winscp	winscp	eq	5.0.9
winscp:winscp	winscp	eq	5.0.7
winscp:winscp	winscp	eq	3.8_beta
winscp:winscp	winscp	eq	5.0.5
winscp:winscp	winscp	eq	5.1.4
winscp:winscp	winscp	eq	5.1.2
winscp:winscp	winscp	eq	4.2.7