PT-2017-8921 · Simon Tatham · Putty

Published 2017-01-30 · Updated 2022-05-01 · CVE-2016-6167

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Putty beta version 0.67

Description The issue allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) UxTheme.dll or (2) ntmarta.dll file in the current working directory.

Recommendations For Putty beta version 0.67, consider removing or restricting access to the UxTheme.dll and ntmarta.dll files in the current working directory to minimize the risk of exploitation.

Exploit

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2016-6167

Affected Products

Putty

References · 5

• 🔥 https://packetstormsecurity.com/files/137742/Putty-Beta-0.67-DLL-Hijacking.html · Exploit
• https://osv.dev/vulnerability/CVE-2016-6167 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6167 · Security Note
• http://securityfocus.com/archive/1/538848/100/0/threaded · Note
• http://securitytracker.com/id/1036236 · Note