Red Hat Bugzilla – Bug 1279425
CVE-2015-5309 putty: Integer overflow and buffer underrun in terminal emulator's ECH handling
Last modified: 2015-12-01 14:50:30 EST
A potentially memory-corrupting integer overflow in the handling of ECH (erase characters) control sequence in the terminal emulator was found in putty versions between 0.54 and 0.65. To exploit a vulnerability in the terminal emulator, an attacker must be able to insert a carefully crafted escape sequence into the terminal stream. For a PuTTY SSH session, this must be before encryption, so the attacker likely needs access to the server the victim is connecting to. For instance, an attacker on a multi-user machine that you connect to could trick victim into running cat on a file they control containing a malicious escape sequence.
The vulnerability arises because PuTTY uses signed integer variables to hold the number of characters to be erased and doesn't adequately check for overflow. This means that by passing a very large parameter to ECH, an attacker could cause check_boundary to inspect memory outside the terminal buffer. Were it to find UCSWIDE there, it would corrupt some nearby memory. This might be exploitable if the attacker could arrange for UCSWIDE to be in memory somewhere near a sensitive data structure.
Created putty tracking bugs for this issue:
Affects: fedora-all [bug 1279426]
Affects: epel-5 [bug 1279427]
Affects: epel-6 [bug 1279428]
putty-0.63-5.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report.
putty-0.66-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
putty-0.63-5.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
putty-0.66-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.