Vulnerabilities > CVE-2013-4207 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
PARTIAL Summary
Buffer overflow in sshbn.c in PuTTY before 0.63 allows remote SSH servers to cause a denial of service (crash) via an invalid DSA signature that is not properly handled during computation of a modular inverse and triggers the overflow during a division by zero by the bignum functionality, a different vulnerability than CVE-2013-4206.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Overflow Buffers Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
- Client-side Injection-induced Buffer Overflow This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
- Filter Failure through Buffer Overflow In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
- MIME Conversion An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
Nessus
NASL family Windows NASL id WINSCP_5_1_7.NASL description The WinSCP program installed on the remote host is a version prior to 5.1.7. It therefore contains code from PuTTY that is affected by the following vulnerabilities related to PuTTY : - An overflow error exists that allows heap corruption when handling DSA signatures. (CVE-2013-4206) - A buffer overflow error exists related to modular inverse calculation, non-coprime values, and DSA signature verification. (CVE-2013-4207) - An error exists that allows disclosure of private key material. (CVE-2013-4208) last seen 2020-06-01 modified 2020-06-02 plugin id 72389 published 2014-02-07 reporter This script is Copyright (C) 2014-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/72389 title WinSCP < 5.1.7 Multiple Vulnerabilities code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(72389); script_version("1.4"); script_cvs_date("Date: 2018/11/15 20:50:29"); script_cve_id("CVE-2013-4206", "CVE-2013-4207", "CVE-2013-4208"); script_bugtraq_id(61644, 61645, 61649); script_name(english:"WinSCP < 5.1.7 Multiple Vulnerabilities"); script_summary(english:"Checks version of WinSCP."); script_set_attribute(attribute:"synopsis", value: "The remote Windows host has an application installed that is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The WinSCP program installed on the remote host is a version prior to 5.1.7. It therefore contains code from PuTTY that is affected by the following vulnerabilities related to PuTTY : - An overflow error exists that allows heap corruption when handling DSA signatures. (CVE-2013-4206) - A buffer overflow error exists related to modular inverse calculation, non-coprime values, and DSA signature verification. (CVE-2013-4207) - An error exists that allows disclosure of private key material. (CVE-2013-4208)"); script_set_attribute(attribute:"see_also", value:"https://winscp.net/tracker/show_bug.cgi?id=1039"); script_set_attribute(attribute:"see_also", value:"https://winscp.net/eng/docs/history#5.1.7"); # http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-modmul.html script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?20c27652"); # http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-bignum-division-by-zero.html script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e1b0243c"); # http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7bdd07a8"); script_set_attribute(attribute:"solution", value:"Upgrade to WinSCP version 5.1.7 / 5.2.4 beta or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"vuln_publication_date", value:"2013/08/06"); script_set_attribute(attribute:"patch_publication_date", value:"2013/08/14"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/02/07"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:winscp:winscp"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Windows"); script_copyright(english:"This script is Copyright (C) 2014-2018 Tenable Network Security, Inc."); script_dependencies("winscp_installed.nbin"); script_require_keys("installed_sw/WinSCP"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("install_func.inc"); app = 'WinSCP'; fixed_version = '5.1.7 / 5.2.4 beta (5.2.4.3548)'; install = get_single_install(app_name:app, exit_if_unknown_ver:TRUE); version = install['version']; path = install['path']; if ( # < 5.1.7 ver_compare(ver:version, fix:"5.1.7", strict:FALSE) < 0 || # 5.2.x (version =~ "^5\.2\." && ver_compare(ver:version, fix:"5.2.4.3548", strict:FALSE) < 0) ) { port = get_kb_item("SMB/transport"); if (!port) port = 445; if (report_verbosity > 0) { report = '\n Path : ' + path + '\n Installed version : ' + version + '\n Fixed versions : ' + fixed_version + '\n'; security_warning(port:port, extra:report); } else security_warning(port); } else audit(AUDIT_INST_PATH_NOT_VULN, app, version, path);
NASL family Fedora Local Security Checks NASL id FEDORA_2013-14706.NASL description Merge further fixes from PuTTY to address CVE-2013-4206, CVE-2013-4207, CVE-2013-4208 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-08-20 plugin id 69392 published 2013-08-20 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/69392 title Fedora 19 : filezilla-3.7.3-1.fc19 (2013-14706) NASL family Fedora Local Security Checks NASL id FEDORA_2013-14676.NASL description This is an update that fixes several bugs, for details see upstream announcement: http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html This is an update that fixes four CVEs: CVE-2013-4206 CVE-2013-4207 CVE-2013-4208 CVE-2013-4852 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-08-21 plugin id 69411 published 2013-08-21 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69411 title Fedora 18 : putty-0.63-1.fc18 (2013-14676) NASL family Windows NASL id PUTTY_063.NASL description The remote host has an installation of PuTTY version 0.52 or greater but earlier than version 0.63. As such, it is reportedly affected by the following vulnerabilities : - An overflow error exists in the function last seen 2020-06-01 modified 2020-06-02 plugin id 69318 published 2013-08-13 reporter This script is Copyright (C) 2013-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69318 title PuTTY 0.52 to 0.62 Multiple Vulnerabilities NASL family SuSE Local Security Checks NASL id OPENSUSE-2013-650.NASL description FileZilla was updated to version 3.7.3 to add various features, fix bugs and also security issues in the embedded putty ssh client. Full changelog: https://filezilla-project.org/changelog.php - Noteworthy changes : - Apply a fix for a security vulnerability in PuTTY as used in FileZilla to handle SFTP. See CVE-2013-4852 for reference. - Merge further fixes from PuTTY to address CVE-2013-4206, CVE-2013-4207, CVE-2013-4208 - Version bump to 3.7.0.1 - Fix issues with bundled gnutls - Update translations - Update to version 3.7.0. Changes since 3.6.0.2 : - Show total transfer speed as tooltip over the transfer indicators - List supported protocols in tooltip of host field in quickconnect bar - Use TLS instead of the deprecated term SSL - Reworded text when saving of passwords is disabled, do not refer to kiosk mode - Improved usability of Update page in settings dialog - Improve SFTP performance - When navigating to the parent directory, highlight the former child - When editing files, use high priority for the transfers - Add label to size conditions in filter conditions dialog indicating that the unit is bytes - Ignore drag&drop operations where source and target are identical and clarify the wording in some drop error cases - Trim whitespace from the entered port numbers - Slightly darker color of inactive tabs - Ignore .. item in the file list context menus if multiple items are selected - Display TLS version and key exchange algorithm in certificate and encryption details dialog for FTP over TLS connections. - Fix handling of remote paths containing double-quotes - Fix crash when opening local directories in Explorer if the name contained characters not representable in the locale last seen 2020-06-05 modified 2014-06-13 plugin id 75120 published 2014-06-13 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/75120 title openSUSE Security Update : filezilla (openSUSE-SU-2013:1347-1) NASL family Fedora Local Security Checks NASL id FEDORA_2013-14656.NASL description This is an update that fixes many bugs, for details see upstream announcement: http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html This is an update that fixes four CVEs: CVE-2013-4206 CVE-2013-4207 CVE-2013-4208 CVE-2013-4852 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-08-21 plugin id 69410 published 2013-08-21 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69410 title Fedora 19 : putty-0.63-1.fc19 (2013-14656) NASL family Windows NASL id FILEZILLA_373.NASL description The version of FileZilla Client on the remote host is a version prior to 3.7.3. As such, it is affected by multiple vulnerabilities : - A buffer underrun vulnerability exists that occurs when verifying a DSA signature when using SFTP. (CVE-2013-4206) - A remote buffer overflow vulnerability exists that is triggered when processing a specially crafted DSA signature when using SFTP. (CVE-2013-4207) - Multiple information disclosure vulnerabilities exist due to improper cleaning of private keys used in SFTP sessions. An attacker could exploit these issues by tricking a user into connecting to a specially crafted SFTP server. This can lead to code execution, denial of service, and access to sensitive information like SFTP login passwords, obsolete session keys, public-key pass phrases, and the private halves of public keys. (CVE-2013-4208) last seen 2020-06-01 modified 2020-06-02 plugin id 69494 published 2013-08-13 reporter This script is Copyright (C) 2013-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/69494 title FileZilla Client < 3.7.3 Multiple Vulnerabilities NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201309-08.NASL description The remote host is affected by the vulnerability described in GLSA-201309-08 (FileZilla: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in FileZilla. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to connect to a malicious server, resulting in possible arbitrary code execution or a Denial of Service. Additionally, a local attacker could read sensitive memory, potentially resulting in password disclosure. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 69899 published 2013-09-15 reporter This script is Copyright (C) 2013-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/69899 title GLSA-201309-08 : FileZilla: Multiple vulnerabilities NASL family Fedora Local Security Checks NASL id FEDORA_2013-14794.NASL description Merge further fixes from PuTTY to address CVE-2013-4206, CVE-2013-4207, CVE-2013-4208 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-09-30 plugin id 70204 published 2013-09-30 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/70204 title Fedora 18 : filezilla-3.7.3-1.fc18 (2013-14794) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_4B448A96FF7311E2B28D080027EF73EC.NASL description Simon Tatham reports : This [0.63] release fixes multiple security holes in previous versions of PuTTY, which can allow an SSH-2 server to make PuTTY overrun or underrun buffers and crash. [...] These vulnerabilities can be triggered before host key verification, which means that you are not even safe if you trust the server you think you last seen 2020-06-01 modified 2020-06-02 plugin id 69250 published 2013-08-08 reporter This script is Copyright (C) 2013-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69250 title FreeBSD : PuTTY -- Four security holes in versions before 0.63 (4b448a96-ff73-11e2-b28d-080027ef73ec) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-2736.NASL description Several vulnerabilities where discovered in PuTTY, a Telnet/SSH client for X. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2013-4206 Mark Wooding discovered a heap-corrupting buffer underrun bug in the modmul function which performs modular multiplication. As the modmul function is called during validation of any DSA signature received by PuTTY, including during the initial key exchange phase, a malicious server could exploit this vulnerability before the client has received and verified a host key signature. An attack to this vulnerability can thus be performed by a man-in-the-middle between the SSH client and server, and the normal host key protections against man-in-the-middle attacks are bypassed. - CVE-2013-4207 It was discovered that non-coprime values in DSA signatures can cause a buffer overflow in the calculation code of modular inverses when verifying a DSA signature. Such a signature is invalid. This bug however applies to any DSA signature received by PuTTY, including during the initial key exchange phase and thus it can be exploited by a malicious server before the client has received and verified a host key signature. - CVE-2013-4208 It was discovered that private keys were left in memory after being used by PuTTY tools. - CVE-2013-4852 Gergely Eberhardt from SEARCH-LAB Ltd. discovered that PuTTY is vulnerable to an integer overflow leading to heap overflow during the SSH handshake before authentication due to improper bounds checking of the length parameter received from the SSH server. A remote attacker could use this vulnerability to mount a local denial of service attack by crashing the putty client. Additionally this update backports some general proactive potentially security-relevant tightening from upstream. last seen 2020-03-17 modified 2013-08-13 plugin id 69313 published 2013-08-13 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69313 title Debian DSA-2736-1 : putty - several vulnerabilities
Seebug
bulletinFamily | exploit |
description | BUGTRAQ ID: 61649 CVE(CAN) ID: CVE-2013-4207 PuTTY是Windows和Unix平台上的PuTTYTelnet和SSH的实现,带有xterm终端模拟器 PuTTY 0.52 - 0.63在验证DSA签名的模逆计算中存在缓冲区溢出漏洞,攻击者可以使用此漏洞进行拒绝服务攻击甚至执行任意代码 0 Simon Tatham PuTTY 0.52 - 0.63 厂商补丁: Simon Tatham ------------ 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: http://www.chiark.greenend.org.uk/~sgtatham/putty/ |
id | SSV:60945 |
last seen | 2017-11-19 |
modified | 2013-08-11 |
published | 2013-08-11 |
reporter | Root |
title | PuTTY DSA签名远程缓冲区溢出漏洞(CVE-2013-4207) |
References
- http://secunia.com/advisories/54379
- http://www.debian.org/security/2013/dsa-2736
- http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-bignum-division-by-zero.html
- http://www.openwall.com/lists/oss-security/2013/08/06/11
- http://lists.opensuse.org/opensuse-updates/2013-08/msg00035.html
- http://secunia.com/advisories/54533