PT-2021-4019 · Putty+1 · Putty+1

Fabian Baeumer + 2 · Published 2021-06-19 · Updated 2024-07-03 · CVE-2021-36367

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions PuTTY versions through 0.75

Description The issue is related to insufficient authentication data verification in the implementation of the SSH protocol in PuTTY. This can allow a remote attacker to gain unauthorized access to protected information. Specifically, PuTTY proceeds with establishing an SSH session even if it has never sent a substantive authentication response, making it easier for an attacker-controlled SSH server to present a later spoofed authentication prompt. This can be used to capture credential data for purposes undesired by the client user.

Recommendations For PuTTY versions through 0.75, update to a version that addresses this issue to prevent unauthorized access. As a temporary workaround, consider disabling the use of SSH sessions until a patch is available. Restrict access to sensitive information and credentials when using PuTTY to minimize the risk of exploitation.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

ALT-PU-2021-2266

ALT-PU-2023-4867

BDU:2021-04545

CVE-2021-36367

DLA-3794-1

DSA-5588-1

Affected Products

Alt Linux

Putty

References · 25

• https://osv.dev/vulnerability/CVE-2021-36367 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2021-36367 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04545 · Security Note
• https://debian.org/security/2023/dsa-5588 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-36367 · Security Note
• https://osv.dev/vulnerability/DLA-3794-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-36367 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5588-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-36367 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-36367 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-36367 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36367 · Security Note
• https://t.me/cvenotify/17600 · Telegram Post
• https://t.me/cvenotify/65057 · Telegram Post
• https://t.me/cvenotify/17367 · Telegram Post