Description
PuTTY 0.53b and earlier does not clear logon credentials from memory, including plaintext passwords, which could allow attackers with access to memory to steal the SSH credentials.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | putty | 0.53-b-2003-01-04-1 | — |
| Debian 13 | putty | 0.53-b-2003-01-04-1 | — |
| Debian 12 | putty | 0.53-b-2003-01-04-1 | — |
References
- 20030129 iDEFENSE Security Advisory 01.28.03: SSH2 Clients Insecurely Store Passwords mailing-list
- 1006014 vdb-entry
- 6724 vdb-entry
- http://www.idefense.com/advisory/01.28.03.txt