Bug 1279425 - (CVE-2015-5309) CVE-2015-5309 putty: Integer overflow and buffer underrun in terminal emulator's ECH handling
CVE-2015-5309 putty: Integer overflow and buffer underrun in terminal emulato...
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
impact=low,public=20151107,reported=2...
: Security
Depends On: 1279426 1279427 1279428
Blocks:
  Show dependency treegraph
 
Reported: 2015-11-09 07:56 EST by Adam Mariš
Modified: 2015-12-01 14:50 EST (History)
4 users (show)

See Also:
Fixed In Version: putty 0.66
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Adam Mariš 2015-11-09 07:56:07 EST
A potentially memory-corrupting integer overflow in the handling of ECH (erase characters) control sequence in the terminal emulator was found in putty versions between 0.54 and 0.65. To exploit a vulnerability in the terminal emulator, an attacker must be able to insert a carefully crafted escape sequence into the terminal stream. For a PuTTY SSH session, this must be before encryption, so the attacker likely needs access to the server the victim is connecting to. For instance, an attacker on a multi-user machine that you connect to could trick victim into running cat on a file they control containing a malicious escape sequence.
The vulnerability arises because PuTTY uses signed integer variables to hold the number of characters to be erased and doesn't adequately check for overflow. This means that by passing a very large parameter to ECH, an attacker could cause check_boundary to inspect memory outside the terminal buffer. Were it to find UCSWIDE there, it would corrupt some nearby memory. This might be exploitable if the attacker could arrange for UCSWIDE to be in memory somewhere near a sensitive data structure. 

Upstream patch:

http://tartarus.org/~simon-git/gitweb/?p=putty.git;a=commit;h=6056396f77cafc7e40da4d09f1d6212408dcb065

External reference:

http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html
Comment 1 Adam Mariš 2015-11-09 07:56:38 EST
Created putty tracking bugs for this issue:

Affects: fedora-all [bug 1279426]
Affects: epel-5 [bug 1279427]
Affects: epel-6 [bug 1279428]
Comment 2 Fedora Update System 2015-12-01 12:21:11 EST
putty-0.63-5.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report.
Comment 3 Fedora Update System 2015-12-01 12:52:33 EST
putty-0.66-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2015-12-01 13:24:21 EST
putty-0.63-5.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2015-12-01 14:50:30 EST
putty-0.66-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.