PT-2015-5636 · Simon Tatham+1 · Putty+1

Patrick Coleman · Published 2015-03-03 · Updated 2024-06-15 · CVE-2015-2157

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PuTTY versions 0.51 through 0.63

Description The issue concerns the ssh2 load userkey and ssh2 save userkey functions, which do not properly wipe SSH-2 private keys from memory. This allows local users to obtain sensitive information by reading the memory.

Recommendations For PuTTY versions 0.51 through 0.63, update to a version that properly handles the wiping of SSH-2 private keys from memory to prevent sensitive information disclosure.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2015-1251

CVE-2015-2157

DLA-173-1

DSA-3190-1

MGASA-2015-0098

OPENSUSE-SU-2024:10374-1

Affected Products

Alt Linux

Putty

References · 33

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2157 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151790.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10374-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-2157 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-2157 · Security Note
• http://chiark.greenend.org.uk/~sgtatham/putty/changes.html · Vendor Advisory
• http://debian.org/security/2015/dsa-3190 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-2157 · Vendor Advisory
• http://chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped-2.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0098 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-2157 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2015-03/msg00032.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-2157 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151933.html · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3190-1 · Vendor Advisory