|Summary:||CVE-2015-5309 putty: Integer overflow and buffer underrun in terminal emulator's ECH handling|
|Product:||[Other] Security Response||Reporter:||Adam Mariš <amaris>|
|Component:||vulnerability||Assignee:||Red Hat Product Security <security-response-team>|
|Status:||CLOSED UPSTREAM||QA Contact:|
|Version:||unspecified||CC:||carnil, fedora, jskarvad, tremble|
|Fixed In Version:||putty 0.66||Doc Type:||Bug Fix|
|Doc Text:||Story Points:||---|
|Last Closed:||2019-06-08 02:45:11 UTC||Type:||---|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Cloudforms Team:||---||Target Upstream Version:|
|Bug Depends On:||1279426, 1279427, 1279428|
Description Adam Mariš 2015-11-09 12:56:07 UTC
A potentially memory-corrupting integer overflow in the handling of ECH (erase characters) control sequence in the terminal emulator was found in putty versions between 0.54 and 0.65. To exploit a vulnerability in the terminal emulator, an attacker must be able to insert a carefully crafted escape sequence into the terminal stream. For a PuTTY SSH session, this must be before encryption, so the attacker likely needs access to the server the victim is connecting to. For instance, an attacker on a multi-user machine that you connect to could trick victim into running cat on a file they control containing a malicious escape sequence. The vulnerability arises because PuTTY uses signed integer variables to hold the number of characters to be erased and doesn't adequately check for overflow. This means that by passing a very large parameter to ECH, an attacker could cause check_boundary to inspect memory outside the terminal buffer. Were it to find UCSWIDE there, it would corrupt some nearby memory. This might be exploitable if the attacker could arrange for UCSWIDE to be in memory somewhere near a sensitive data structure. Upstream patch: http://tartarus.org/~simon-git/gitweb/?p=putty.git;a=commit;h=6056396f77cafc7e40da4d09f1d6212408dcb065 External reference: http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html
Comment 1 Adam Mariš 2015-11-09 12:56:38 UTC
Created putty tracking bugs for this issue: Affects: fedora-all [bug 1279426] Affects: epel-5 [bug 1279427] Affects: epel-6 [bug 1279428]
Comment 2 Fedora Update System 2015-12-01 17:21:11 UTC
putty-0.63-5.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report.
Comment 3 Fedora Update System 2015-12-01 17:52:33 UTC
putty-0.66-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2015-12-01 18:24:21 UTC
putty-0.63-5.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2015-12-01 19:50:30 UTC
putty-0.66-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
Comment 6 Product Security DevOps Team 2019-06-08 02:45:11 UTC
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.