CVE-2017-6542

NONE EPSS 97.3%
Published Mar 27, 20179y ago · Modified Jun 17, 20262w ago
Find Similar
Published Mar 27, 2017 9y ago
Last Modified Jun 17, 2026 2w ago

Description

The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message and leveraging the ability to connect to the Unix-domain socket representing the forwarded agent connection, which trigger a buffer overflow.

Threat Intelligence

EPSS Exploit Probability
97.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer Memory Safety

Affected Products 3

VendorProductVersionRange
puttyputty* ≤0.67
opensuseleap42.2any
opensuse_projectleap42.1any

References 8

  • lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2017-03/msg00055.html
    Third Party Advisory
  • chiark.greenend.org.uk http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-fwd-overflow.html
    PatchVendor Advisory
  • securityfocus.com http://www.securityfocus.com/bid/97156
    Third Party AdvisoryVDB Entry
  • securitytracker.com http://www.securitytracker.com/id/1038067
  • git.tartarus.org https://git.tartarus.org/?p=simon/putty.git%3Ba=commitdiff%3Bh=4ff22863d895cb7ebfced4cf923a012a614adaa8
  • security.gentoo.org https://security.gentoo.org/glsa/201703-03
    Third Party AdvisoryVDB Entry
  • security.gentoo.org https://security.gentoo.org/glsa/201706-09
  • exploit-db.com https://www.exploit-db.com/exploits/42137/

Remediation

  • chiark.greenend.org.uk http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-fwd-overflow.html
    PatchVendor Advisory