Bug 1279425 (CVE-2015-5309) - CVE-2015-5309 putty: Integer overflow and buffer underrun in terminal emulator's ECH handling
Summary: CVE-2015-5309 putty: Integer overflow and buffer underrun in terminal emulato...
Keywords:
Status: CLOSED UPSTREAM
Alias: CVE-2015-5309
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1279426 1279427 1279428
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-11-09 12:56 UTC by Adam Mariš
Modified: 2019-09-29 13:39 UTC (History)
4 users (show)

Fixed In Version: putty 0.66
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-06-08 02:45:11 UTC


Attachments (Terms of Use)

Description Adam Mariš 2015-11-09 12:56:07 UTC
A potentially memory-corrupting integer overflow in the handling of ECH (erase characters) control sequence in the terminal emulator was found in putty versions between 0.54 and 0.65. To exploit a vulnerability in the terminal emulator, an attacker must be able to insert a carefully crafted escape sequence into the terminal stream. For a PuTTY SSH session, this must be before encryption, so the attacker likely needs access to the server the victim is connecting to. For instance, an attacker on a multi-user machine that you connect to could trick victim into running cat on a file they control containing a malicious escape sequence.
The vulnerability arises because PuTTY uses signed integer variables to hold the number of characters to be erased and doesn't adequately check for overflow. This means that by passing a very large parameter to ECH, an attacker could cause check_boundary to inspect memory outside the terminal buffer. Were it to find UCSWIDE there, it would corrupt some nearby memory. This might be exploitable if the attacker could arrange for UCSWIDE to be in memory somewhere near a sensitive data structure. 

Upstream patch:

http://tartarus.org/~simon-git/gitweb/?p=putty.git;a=commit;h=6056396f77cafc7e40da4d09f1d6212408dcb065

External reference:

http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html

Comment 1 Adam Mariš 2015-11-09 12:56:38 UTC
Created putty tracking bugs for this issue:

Affects: fedora-all [bug 1279426]
Affects: epel-5 [bug 1279427]
Affects: epel-6 [bug 1279428]

Comment 2 Fedora Update System 2015-12-01 17:21:11 UTC
putty-0.63-5.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report.

Comment 3 Fedora Update System 2015-12-01 17:52:33 UTC
putty-0.66-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2015-12-01 18:24:21 UTC
putty-0.63-5.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2015-12-01 19:50:30 UTC
putty-0.66-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

Comment 6 Product Security DevOps Team 2019-06-08 02:45:11 UTC
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.


Note You need to log in before you can comment on or make changes to this bug.