PT-2013-1464 · Simon Tatham · Putty

Vincent Danen · Published 2013-08-23 · Updated 2019-03-21 · CVE-2011-4607

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PuTTY versions 0.59 through 0.61

Description The issue arises during keyboard-interactive authentication when managing user replies. Sensitive process memory is not properly cleared, potentially allowing local users to read login passwords by accessing the process' memory.

Recommendations For versions 0.59 through 0.61, update to a version that properly clears sensitive process memory to prevent potential password exposure.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2011-4607

Affected Products

Putty

References · 8

• http://chiark.greenend.org.uk/~sgtatham/putty/wishlist/password-not-wiped.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-4607 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4607 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2011-4607 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4607 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4607 · Note
• http://seclists.org/oss-sec/2011/q4/500 · Note
• http://seclists.org/oss-sec/2011/q4/499 · Note