Skip to Content.
Sympa Menu

sm-security - Re: [SM-Security] SECURITY UPDATE for crypto/putty

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Seth Alan Woolley <seth AT positivism.org>
  • To: Eric Sandall <eric AT sandall.us>
  • Cc: sm-security AT lists.ibiblio.org
  • Subject: Re: [SM-Security] SECURITY UPDATE for crypto/putty
  • Date: Sun, 20 Feb 2005 21:47:18 -0800

I seem to have missed the pgp-signature on this, is it legitimate? ;)

Seth

On Sun, Feb 20, 2005 at 09:41:36PM -0800, Eric Sandall wrote:
> >From PuTTYs announcement[0][1]:
>
> This version fixes a security hole in previous versions of PuTTY,
> which can allow a malicious SFTP server to attack your client. If
> you use either PSCP or PSFTP, you should upgrade. Users of the main
> PuTTY program are not affected. (However, note that the server must
> have passed host key verification before this attack can be
> launched, so a man-in-the-middle shouldn't be able to attack you if
> you're careful.)
>
> This vulnerability was found by iDEFENSE, who we expect to release
> an advisory on the subject shortly.
>
> The following files are attached for spell crypto/putty:
> DETAILS
> HISTORY
>
> -sandalle
>
> [0]
> http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-readdir.html
> [1]
> http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-string.html
>
> --
> Eric Sandall | Source Mage GNU/Linux Developer
> eric AT sandall.us PGP: 0xA8EFDD61 | http://www.sourcemage.org/
> http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @ WSU
> http://counter.li.org/ #196285 | http://www.shock.wsu.edu/
>
> ----------------------------------------------------------------
> This message was sent using IMP, the Internet Messaging Program.


--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id 00BA3AF3 = 8BE0 A72E A47E A92A 0737 F2FF 7A3F 6D3C 00BA 3AF3
http://smgl.positivism.org:11371/pks/lookup?op=get&search=0x00BA3AF3
Security Team Leader Source Mage GNU/Linux http://www.sourcemage.org

Attachment: pgpyEdqPBy6lf.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page