PT-2003-1349 · Simon Tatham · Putty

H D Moore · Published 2003-03-18 · Updated 2023-05-08 · CVE-2003-0069

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PuTTY version 0.53

Description The issue allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal. This could happen when the user views a file containing the malicious sequence, potentially allowing the attacker to execute arbitrary commands.

Recommendations For PuTTY version 0.53, consider avoiding the use of potentially malicious files or sequences that could exploit this issue until a patch is available. As a temporary workaround, restrict the ability to insert custom character escape sequences into the command line to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2003-0069

Affected Products

Putty

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2003-0069 · Security Note
• http://iss.net/security_center/static/11414.php · Vendor Advisory
• http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2003-0069 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0069 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2003-0069 · Vendor Advisory
• https://t.me/cvenotify/49981 · Telegram Post
• http://osvdb.org/8347 · Note
• https://t.me/cibsecurity/63454 · Telegram Post
• http://marc.info/?l=bugtraq&m=104612710031920&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0069 · Note