CVE-2013-4208
NONE
Published Aug 19, 201312y ago · Modified Jun 16, 20262w ago
Published Aug 19, 2013 12y ago
Last Modified Jun 16, 2026 2w ago
Description
The rsa_verify function in PuTTY before 0.63 (1) does not clear sensitive process memory after use and (2) does not free certain structures containing sensitive process memory, which might allow local users to discover private RSA and DSA keys.
Threat Intelligence
No active exploitation signals — not in CISA KEV and no EPSS score yet.
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure
Affected Products 19
| Vendor | Product | Version | Range |
|---|---|---|---|
| putty | putty | 0.45 | any |
| putty | putty | 0.46 | any |
| putty | putty | 0.47 | any |
| putty | putty | 0.48 | any |
| putty | putty | 0.49 | any |
| putty | putty | 0.50 | any |
| putty | putty | 0.51 | any |
| putty | putty | 0.52 | any |
| putty | putty | 0.53b | any |
| putty | putty | 0.54 | any |
| putty | putty | 0.55 | any |
| putty | putty | 0.56 | any |
| putty | putty | 0.57 | any |
| putty | putty | 0.58 | any |
| putty | putty | 0.59 | any |
| putty | putty | 0.60 | any |
| putty | putty | 0.61 | any |
| simon_tatham | putty | * | ≤0.62 |
| simon_tatham | putty | 0.53 | any |
References 6
- lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2013-08/msg00035.html
- secunia.com http://secunia.com/advisories/54379
- secunia.com http://secunia.com/advisories/54533
- chiark.greenend.org.uk http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html
- debian.org http://www.debian.org/security/2013/dsa-2736
- openwall.com http://www.openwall.com/lists/oss-security/2013/08/06/11
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.