Security bugs are reported here via bugzilla

[Seth Alan Woolley <seth AT positivism.org>]

I seem to have missed the pgp-signature on this, is it legitimate? ;)

Seth

On Sun, Feb 20, 2005 at 09:41:36PM -0800, Eric Sandall wrote:
> >From PuTTYs announcement[0][1]:
> 
> This version fixes a security hole in previous versions of PuTTY,
> which can allow a malicious SFTP server to attack your client. If
> you use either PSCP or PSFTP, you should upgrade. Users of the main
> PuTTY program are not affected. (However, note that the server must
> have passed host key verification before this attack can be
> launched, so a man-in-the-middle shouldn't be able to attack you if
> you're careful.)
> 
> This vulnerability was found by iDEFENSE, who we expect to release
> an advisory on the subject shortly.
> 
> The following files are attached for spell crypto/putty:
> DETAILS
> HISTORY
> 
> -sandalle
> 
> [0]
> http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-readdir.html
> [1]
> http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-string.html
> 
> --
> Eric Sandall                     |  Source Mage GNU/Linux Developer
> eric AT sandall.us PGP: 0xA8EFDD61  |  http://www.sourcemage.org/
> http://eric.sandall.us/          |  SysAdmin @ Inst. Shock Physics @ WSU
> http://counter.li.org/  #196285  |  http://www.shock.wsu.edu/
> 
> ----------------------------------------------------------------
> This message was sent using IMP, the Internet Messaging Program.


-- 
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id 00BA3AF3 = 8BE0 A72E A47E A92A 0737  F2FF 7A3F 6D3C 00BA 3AF3
http://smgl.positivism.org:11371/pks/lookup?op=get&search=0x00BA3AF3
Security Team Leader Source Mage GNU/Linux http://www.sourcemage.org

Attachment: pgpyEdqPBy6lf.pgp
Description: PGP signature