Description
Multiple integer overflows in the (1) sftp_pkt_getstring and (2) fxp_readdir_recv functions in the PSFTP and PSCP clients for PuTTY 0.56, and possibly earlier versions, allow remote malicious web sites to execute arbitrary code via SFTP responses that corrupt the heap after insufficient memory has been allocated.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | putty | 0.57-1 | — |
| Debian 13 | putty | 0.57-1 | — |
| Debian 12 | putty | 0.57-1 | — |
References
- http://www-1.ibm.com/support/docview.wss?uid=ssg1S1002414
- putty-sftppktgetstring-bo(19403) vdb-entry
- 20050221 Multiple PuTTY SFTP Client Packet Parsing Integer Overflow Vulnerabilities third-party-advisory
- 14333 third-party-advisory
- GLSA-200502-28 vendor-advisory
- http://www-1.ibm.com/support/docview.wss?uid=ssg1S1002416
- http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-readdir.html
- http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-string.html
- 17214 third-party-advisory