Skip to Content.
Sympa Menu

sm-security - [SM-Security] SECURITY UPDATE for crypto/putty

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Eric Sandall <eric AT sandall.us>
  • To: sm-security AT lists.ibiblio.org
  • Subject: [SM-Security] SECURITY UPDATE for crypto/putty
  • Date: Sun, 20 Feb 2005 21:41:36 -0800

>From PuTTYs announcement[0][1]:

This version fixes a security hole in previous versions of PuTTY,
which can allow a malicious SFTP server to attack your client. If
you use either PSCP or PSFTP, you should upgrade. Users of the main
PuTTY program are not affected. (However, note that the server must
have passed host key verification before this attack can be
launched, so a man-in-the-middle shouldn't be able to attack you if
you're careful.)

This vulnerability was found by iDEFENSE, who we expect to release
an advisory on the subject shortly.

The following files are attached for spell crypto/putty:
DETAILS
HISTORY

-sandalle

[0]
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-readdir.html
[1]
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-string.html

--
Eric Sandall | Source Mage GNU/Linux Developer
eric AT sandall.us PGP: 0xA8EFDD61 | http://www.sourcemage.org/
http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/ #196285 | http://www.shock.wsu.edu/

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

Attachment: putty-0.57.tar.bz2
Description: Binary data




Archive powered by MHonArc 2.6.24.

Top of Page