PT-2017-8921 · Simon Tatham · Putty

Publicado 2017-01-30 · Atualizado 2022-05-01 · CVE-2016-6167

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Putty beta version 0.67

Description The issue allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) UxTheme.dll or (2) ntmarta.dll file in the current working directory.

Recommendations For Putty beta version 0.67, consider removing or restricting access to the UxTheme.dll and ntmarta.dll files in the current working directory to minimize the risk of exploitation.

Exploit

Correção

Untrusted Search Path

Enumeração de Fraquezas

CWE-426

Identificadores relacionados

CVE-2016-6167

Produtos afetados

Putty

Referências · 5

• 🔥 https://packetstormsecurity.com/files/137742/Putty-Beta-0.67-DLL-Hijacking.html · Exploit
• https://osv.dev/vulnerability/CVE-2016-6167 · Aviso do Fabricante
• http://securityfocus.com/archive/1/538848/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-6167 · Nota de Segurança
• http://securitytracker.com/id/1036236 · Nota