PT-2019-20097 · Simon Tatham · Putty
Published
2019-08-26
·
Updated
2019-08-26
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
putty versions prior to 0.72
Description
The issue affects the obsolete SSH-1 protocol and is available before host key checking. Additionally, there is a vulnerability in all the SSH client tools if a malicious program can impersonate Pageant. A crash can also occur in GSSAPI / Kerberos key exchange if the server provided an ordinary SSH host key as part of the exchange.
Recommendations
For putty versions prior to 0.72, update to version 0.72 or later to resolve the issues. As a temporary workaround, consider restricting access to the SSH client tools until the update is applied. Avoid using the SSH-1 protocol if possible, and ensure that Pageant is properly secured to prevent impersonation.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Putty