PuTTY SSH2 Authentication Password Persistence Weakness

PuTTY does not safely handle password information. Copyright C 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribut...

Debian DSA-717-1 : lsh-utils - buffer overflow, typo

Several security relevant problems have been discovered in lsh, the alternative secure shell v2 SSH2 protocol server. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CAN-2003-0826 Bennett Todd discovered a heap buffer overflow in lshd which could lead...

CVE-2004-1440

Summary: CVE-2004-1440 affects PuTTY before 0.55. The modpow function suffers heap-based buffer overflows that allow remote attackers to execute arbitrary code via a crafted SSH2 packet (base argument larger than mod argument). A second impact is a possible denial of service (client crash) and ar...

CVE-2004-1440

Multiple heap-based buffer overflows in the modpow function in PuTTY before 0.55 allow 1 remote attackers to execute arbitrary code via an SSH2 packet with a base argument that is larger than the mod argument, which causes the modpow function to write memory before the beginning of its buffer, an...

CVE-2004-1440

Multiple heap-based buffer overflows in the modpow function in PuTTY before 0.55 allow 1 remote attackers to execute arbitrary code via an SSH2 packet with a base argument that is larger than the mod argument, which causes the modpow function to write memory before the beginning of its buffer, an...

DEBIAN-CVE-2004-1008

Integer signedness error in the ssh2rdpkt function in PuTTY before 0.56 allows remote attackers to execute arbitrary code via a SSH2MSGDEBUG packet with a modified stringlen parameter, which leads to a buffer overflow...

PuTTY for Symbian OS "SSH2_MSG_DEBUG" Buffer Overflow

No description provided...

CVE-2004-1008

CVE-2004-1008 affects PuTTY prior to 0.56. An integer signedness error in the ssh2_rdpkt function allows an attacker to trigger a buffer overflow via a crafted SSH2_MSG_DEBUG packet (modified stringlen). This enables remote code execution. Remediation: upgrade PuTTY to 0.56 or newer (patched vers...

Hydra: SSH2

This plugin runs Hydra to find SSH2 accounts and passwords by brute force. To use this plugin, enter the 'Logins file' and the 'Passwords file' under the 'Hydra NASL wrappers options' advanced settings block. TRUSTED...

FreeBSD : putty -- buffer overflow vulnerability in ssh2 support (159)

The following package needs to be updated: putty %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkg19518d222d0511d989430050fc56d258.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright 2003-20...

PuTTY SSH2 buffer overflow

Buffer overflow on SSH2MSGDEBUG packet processing...

GLSA-200410-29 : PuTTY: Pre-authentication buffer overflow

The remote host is affected by the vulnerability described in GLSA-200410-29 PuTTY: Pre-authentication buffer overflow PuTTY fails to do proper bounds checking on SSH2MSGDEBUG packets. The 'stringlen' parameter value is incorrectly checked due to signedness issues. Note that this vulnerability is...

PuTTY: Pre-authentication buffer overflow

Background PuTTY is a free implementation of Telnet and SSH for Win32 and Unix platforms, along with an xterm terminal emulator. Description PuTTY fails to do proper bounds checking on SSH2MSGDEBUG packets. The "stringlen" parameter value is incorrectly checked due to signedness issues. Note that...

putty -- buffer overflow vulnerability in ssh2 support

There is a bug in SSH2 support that allows a server to execute malicious code on a connecting PuTTY client. This attack can be performed before host key verification happens, so a different machine -- man in the middle attack -- could fake the machine you are connecting to...

GLSA-200408-04 : PuTTY: Pre-authentication arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-200408-04 PuTTY: Pre-authentication arbitrary code execution PuTTY contains a vulnerability allowing a malicious server to execute arbitrary code on the connecting client before host key verification. Impact : When connecting to a...

Putty < 0.54 SSH2 Authentication Password Persistence Weakness

Binary data 1999.prm...

PuTTY: Pre-authentication arbitrary code execution

Background PuTTY is a free implementation of Telnet and SSH for Win32 and Unix platforms, along with an xterm terminal emulator. Description PuTTY contains a vulnerability allowing a malicious server to execute arbitrary code on the connecting client before host key verification. Impact When...

Cisco SSH2 Server/Client Malformed Packet Remote DoS (CSCdz60229, CSCdy87221, CSCdu75477)

It is possible to make the remote IOS crash when sending it malformed SSH packets during the key exchange. These flaws are documented as CISCO bug ID CSCdz60229, CSCdy87221 and CSCdu75477. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid11383; scriptversion"1.29";...

CVE-2003-0046

AbsoluteTelnet SSH2 client does not clear logon credentials from memory, including plaintext passwords, which could allow attackers with access to memory to steal the SSH credentials...

CVE-2003-0047

SSH2 clients for VanDyke 1 SecureCRT 4.0.2 and 3.4.7, 2 SecureFX 2.1.2 and 2.0.4, and 3 Entunnel 1.0.2 and earlier, do not clear logon credentials from memory, including plaintext passwords, which could allow attackers with access to memory to steal the SSH credentials...