PT-2015-5636 · Simon Tatham+1 · Putty+1

Patrick Coleman · Publicado 2015-03-03 · Atualizado 2024-06-15 · CVE-2015-2157

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PuTTY versions 0.51 through 0.63

Description The issue concerns the ssh2 load userkey and ssh2 save userkey functions, which do not properly wipe SSH-2 private keys from memory. This allows local users to obtain sensitive information by reading the memory.

Recommendations For PuTTY versions 0.51 through 0.63, update to a version that properly handles the wiping of SSH-2 private keys from memory to prevent sensitive information disclosure.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

ALT-PU-2015-1251

CVE-2015-2157

DLA-173-1

DSA-3190-1

MGASA-2015-0098

OPENSUSE-SU-2024:10374-1

Produtos afetados

Alt Linux

Putty

Referências · 33

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2157 · Nota
• https://suse.com/security/cve/CVE-2015-2157 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2157 · Nota de Segurança
• https://packages.debian.org/src:putty · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151790.html · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:10374-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2013-4852 · Nota
• https://suse.com/security/cve/CVE-2015-5309 · Nota
• http://openwall.com/lists/oss-security/2015/02/28/4 · Nota
• http://securityfocus.com/bid/72825 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-2157 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2015-2157 · Nota de Segurança
• http://chiark.greenend.org.uk/~sgtatham/putty/changes.html · Aviso do Fabricante
• http://debian.org/security/2015/dsa-3190 · Aviso do Fabricante
• https://packages.altlinux.org/ru/vuln/CVE-2015-2157 · Nota