Inbound TCP Agent Protocol/3 authentication bypass

Jenkins 2.213 and earlier, LTS 2.204.1 and earlier includes support for the Inbound TCP Agent Protocol/3 for communication between controller and agents. While this protocol has been deprecated in 2018 and was recently removed from Jenkins in 2.214, it could still easily be enabled in Jenkins LTS...

CVE-2020-2099: Use of Insufficiently Random Values

Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonati...

ALPINE-CVE-2017-6542

The sshagentchanneldata function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message and leveraging the ability to connect to the Unix-domain socket representing the forwarded agent connection, which trigger a buffer overfl...

DEBIAN-CVE-2017-6542

The sshagentchanneldata function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message and leveraging the ability to connect to the Unix-domain socket representing the forwarded agent connection, which trigger a buffer overfl...

UBUNTU-CVE-2017-6542

The sshagentchanneldata function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message and leveraging the ability to connect to the Unix-domain socket representing the forwarded agent connection, which trigger a buffer overfl...

CVE-2017-6542

The sshagentchanneldata function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message and leveraging the ability to connect to the Unix-domain socket representing the forwarded agent connection, which trigger a buffer overfl...

PT-2017-17144

Name of the Vulnerable Software and Affected Versions PuTTY versions prior to 0.68 Description The issue allows remote attackers to have an unspecified impact via a large length value in an agent protocol message. This is achieved by leveraging the ability to connect to the Unix-domain socket...

CVE-1999-0395: Undefined Security Weakness

A race condition in the BackWeb Polite Agent Protocol allows an attacker to spoof a BackWeb server...

backweb-spoof.txt

ISS Security Advisory January 18, 1999 Vulnerability in the BackWeb Polite Agent Protocol Synopsis: Internet Security Systems ISS X-Force discovered a vulnerability in the BackWeb Technologies http://www.backweb.com/home.html BackWeb Polite Agent Protocol that allows a user on a local network on...