Security bugs are reported here via bugzilla

[Eric Sandall <eric AT sandall.us>]

>From PuTTYs announcement[0][1]:

This version fixes a security hole in previous versions of PuTTY,
which can allow a malicious SFTP server to attack your client. If
you use either PSCP or PSFTP, you should upgrade. Users of the main
PuTTY program are not affected. (However, note that the server must
have passed host key verification before this attack can be
launched, so a man-in-the-middle shouldn't be able to attack you if
you're careful.)

This vulnerability was found by iDEFENSE, who we expect to release
an advisory on the subject shortly.

The following files are attached for spell crypto/putty:
DETAILS
HISTORY

-sandalle

[0]
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-readdir.html
[1]
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-string.html

--
Eric Sandall                     |  Source Mage GNU/Linux Developer
eric AT sandall.us PGP: 0xA8EFDD61  |  http://www.sourcemage.org/
http://eric.sandall.us/          |  SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/  #196285  |  http://www.shock.wsu.edu/

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

Attachment: putty-0.57.tar.bz2
Description: Binary data