PT-2003-1349 · Simon Tatham · Putty

H D Moore · Publicado 2003-03-18 · Atualizado 2023-05-08 · CVE-2003-0069

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PuTTY version 0.53

Description The issue allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal. This could happen when the user views a file containing the malicious sequence, potentially allowing the attacker to execute arbitrary commands.

Recommendations For PuTTY version 0.53, consider avoiding the use of potentially malicious files or sequences that could exploit this issue until a patch is available. As a temporary workaround, restrict the ability to insert custom character escape sequences into the command line to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2003-0069

Produtos afetados

Putty

Referências · 11

• https://nvd.nist.gov/vuln/detail/CVE-2003-0069 · Nota de Segurança
• http://iss.net/security_center/static/11414.php · Aviso do Fabricante
• https://t.me/cvenotify/49981 · Publicação no Telegram
• http://osvdb.org/8347 · Nota
• https://t.me/cibsecurity/63454 · Publicação no Telegram
• http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=104612710031920&w=2 · Nota
• https://osv.dev/vulnerability/CVE-2003-0069 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0069 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2003-0069 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0069 · Nota