6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.015 Low
EPSS
Percentile
86.9%
The remote host is using a vulnerable version of PuTTY or of a PuTTY-based software (eg. PSCP or WinSCP). PuTTY is a Telnet/SSH client built for Linux and UNIX variants as well as Microsoft Windows operating systems. Reportedly PuTTY is affected by a buffer overflow (CVE-2013-4207) that could lead to remote code execution, a buffer underflow (CVE-2013-4206) that can corrupt the heap or cause a denial of service condition, and multiple information disclosure vulnerabilities due to its failure to properly clean the private keys typed by the user from memory during authentication.
Binary data 6987.prm
Vendor | Product | Version | CPE |
---|---|---|---|
simon_tatham | putty | cpe:/a:simon_tatham:putty |
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4206
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4207
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4208
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4852
seclists.org/oss-sec/2013/q3/291
www.chiark.greenend.org.uk/~sgtatham/putty/download.html
www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html
www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-bignum-division-by-zero.html
www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-modmul.html