Vulnerabilities > CVE-2013-4207 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL

Summary

Buffer overflow in sshbn.c in PuTTY before 0.63 allows remote SSH servers to cause a denial of service (crash) via an invalid DSA signature that is not properly handled during computation of a modular inverse and triggers the overflow during a division by zero by the bignum functionality, a different vulnerability than CVE-2013-4206.

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

  • NASL familyWindows
    NASL idWINSCP_5_1_7.NASL
    descriptionThe WinSCP program installed on the remote host is a version prior to 5.1.7. It therefore contains code from PuTTY that is affected by the following vulnerabilities related to PuTTY : - An overflow error exists that allows heap corruption when handling DSA signatures. (CVE-2013-4206) - A buffer overflow error exists related to modular inverse calculation, non-coprime values, and DSA signature verification. (CVE-2013-4207) - An error exists that allows disclosure of private key material. (CVE-2013-4208)
    last seen2020-06-01
    modified2020-06-02
    plugin id72389
    published2014-02-07
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/72389
    titleWinSCP < 5.1.7 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(72389);
      script_version("1.4");
      script_cvs_date("Date: 2018/11/15 20:50:29");
    
      script_cve_id("CVE-2013-4206", "CVE-2013-4207", "CVE-2013-4208");
      script_bugtraq_id(61644, 61645, 61649);
    
      script_name(english:"WinSCP < 5.1.7 Multiple Vulnerabilities");
      script_summary(english:"Checks version of WinSCP.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host has an application installed that is affected
    by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The WinSCP program installed on the remote host is a version prior to
    5.1.7. It therefore contains code from PuTTY that is affected by the
    following vulnerabilities related to PuTTY :
    
      - An overflow error exists that allows heap corruption
        when handling DSA signatures. (CVE-2013-4206)
    
      - A buffer overflow error exists related to modular
        inverse calculation, non-coprime values, and DSA
        signature verification. (CVE-2013-4207)
    
      - An error exists that allows disclosure of private key
        material. (CVE-2013-4208)");
      script_set_attribute(attribute:"see_also", value:"https://winscp.net/tracker/show_bug.cgi?id=1039");
      script_set_attribute(attribute:"see_also", value:"https://winscp.net/eng/docs/history#5.1.7");
      # http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-modmul.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?20c27652");
      # http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-bignum-division-by-zero.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e1b0243c");
      # http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7bdd07a8");
      script_set_attribute(attribute:"solution", value:"Upgrade to WinSCP version 5.1.7 / 5.2.4 beta or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2013/08/06");
      script_set_attribute(attribute:"patch_publication_date", value:"2013/08/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/02/07");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:winscp:winscp");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2014-2018 Tenable Network Security, Inc.");
    
      script_dependencies("winscp_installed.nbin");
      script_require_keys("installed_sw/WinSCP");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("install_func.inc");
    
    app = 'WinSCP';
    fixed_version = '5.1.7 / 5.2.4 beta (5.2.4.3548)';
    
    install = get_single_install(app_name:app, exit_if_unknown_ver:TRUE);
    
    version = install['version'];
    path = install['path'];
    
    if (
      # < 5.1.7
      ver_compare(ver:version, fix:"5.1.7", strict:FALSE) < 0 ||
      # 5.2.x
      (version =~ "^5\.2\." && ver_compare(ver:version, fix:"5.2.4.3548", strict:FALSE) < 0)
    )
    {
      port = get_kb_item("SMB/transport");
      if (!port) port = 445;
    
      if (report_verbosity > 0)
      {
        report =
          '\n  Path              : ' + path +
          '\n  Installed version : ' + version +
          '\n  Fixed versions    : ' + fixed_version + 
          '\n';
        security_warning(port:port, extra:report);
      }
      else security_warning(port);
    }
    else audit(AUDIT_INST_PATH_NOT_VULN, app, version, path);
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2013-14706.NASL
    descriptionMerge further fixes from PuTTY to address CVE-2013-4206, CVE-2013-4207, CVE-2013-4208 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2013-08-20
    plugin id69392
    published2013-08-20
    reporterThis script is Copyright (C) 2013-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/69392
    titleFedora 19 : filezilla-3.7.3-1.fc19 (2013-14706)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2013-14676.NASL
    descriptionThis is an update that fixes several bugs, for details see upstream announcement: http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html This is an update that fixes four CVEs: CVE-2013-4206 CVE-2013-4207 CVE-2013-4208 CVE-2013-4852 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2013-08-21
    plugin id69411
    published2013-08-21
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69411
    titleFedora 18 : putty-0.63-1.fc18 (2013-14676)
  • NASL familyWindows
    NASL idPUTTY_063.NASL
    descriptionThe remote host has an installation of PuTTY version 0.52 or greater but earlier than version 0.63. As such, it is reportedly affected by the following vulnerabilities : - An overflow error exists in the function
    last seen2020-06-01
    modified2020-06-02
    plugin id69318
    published2013-08-13
    reporterThis script is Copyright (C) 2013-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69318
    titlePuTTY 0.52 to 0.62 Multiple Vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2013-650.NASL
    descriptionFileZilla was updated to version 3.7.3 to add various features, fix bugs and also security issues in the embedded putty ssh client. Full changelog: https://filezilla-project.org/changelog.php - Noteworthy changes : - Apply a fix for a security vulnerability in PuTTY as used in FileZilla to handle SFTP. See CVE-2013-4852 for reference. - Merge further fixes from PuTTY to address CVE-2013-4206, CVE-2013-4207, CVE-2013-4208 - Version bump to 3.7.0.1 - Fix issues with bundled gnutls - Update translations - Update to version 3.7.0. Changes since 3.6.0.2 : - Show total transfer speed as tooltip over the transfer indicators - List supported protocols in tooltip of host field in quickconnect bar - Use TLS instead of the deprecated term SSL - Reworded text when saving of passwords is disabled, do not refer to kiosk mode - Improved usability of Update page in settings dialog - Improve SFTP performance - When navigating to the parent directory, highlight the former child - When editing files, use high priority for the transfers - Add label to size conditions in filter conditions dialog indicating that the unit is bytes - Ignore drag&drop operations where source and target are identical and clarify the wording in some drop error cases - Trim whitespace from the entered port numbers - Slightly darker color of inactive tabs - Ignore .. item in the file list context menus if multiple items are selected - Display TLS version and key exchange algorithm in certificate and encryption details dialog for FTP over TLS connections. - Fix handling of remote paths containing double-quotes - Fix crash when opening local directories in Explorer if the name contained characters not representable in the locale
    last seen2020-06-05
    modified2014-06-13
    plugin id75120
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75120
    titleopenSUSE Security Update : filezilla (openSUSE-SU-2013:1347-1)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2013-14656.NASL
    descriptionThis is an update that fixes many bugs, for details see upstream announcement: http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html This is an update that fixes four CVEs: CVE-2013-4206 CVE-2013-4207 CVE-2013-4208 CVE-2013-4852 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2013-08-21
    plugin id69410
    published2013-08-21
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69410
    titleFedora 19 : putty-0.63-1.fc19 (2013-14656)
  • NASL familyWindows
    NASL idFILEZILLA_373.NASL
    descriptionThe version of FileZilla Client on the remote host is a version prior to 3.7.3. As such, it is affected by multiple vulnerabilities : - A buffer underrun vulnerability exists that occurs when verifying a DSA signature when using SFTP. (CVE-2013-4206) - A remote buffer overflow vulnerability exists that is triggered when processing a specially crafted DSA signature when using SFTP. (CVE-2013-4207) - Multiple information disclosure vulnerabilities exist due to improper cleaning of private keys used in SFTP sessions. An attacker could exploit these issues by tricking a user into connecting to a specially crafted SFTP server. This can lead to code execution, denial of service, and access to sensitive information like SFTP login passwords, obsolete session keys, public-key pass phrases, and the private halves of public keys. (CVE-2013-4208)
    last seen2020-06-01
    modified2020-06-02
    plugin id69494
    published2013-08-13
    reporterThis script is Copyright (C) 2013-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/69494
    titleFileZilla Client < 3.7.3 Multiple Vulnerabilities
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201309-08.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201309-08 (FileZilla: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in FileZilla. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to connect to a malicious server, resulting in possible arbitrary code execution or a Denial of Service. Additionally, a local attacker could read sensitive memory, potentially resulting in password disclosure. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id69899
    published2013-09-15
    reporterThis script is Copyright (C) 2013-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/69899
    titleGLSA-201309-08 : FileZilla: Multiple vulnerabilities
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2013-14794.NASL
    descriptionMerge further fixes from PuTTY to address CVE-2013-4206, CVE-2013-4207, CVE-2013-4208 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2013-09-30
    plugin id70204
    published2013-09-30
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/70204
    titleFedora 18 : filezilla-3.7.3-1.fc18 (2013-14794)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_4B448A96FF7311E2B28D080027EF73EC.NASL
    descriptionSimon Tatham reports : This [0.63] release fixes multiple security holes in previous versions of PuTTY, which can allow an SSH-2 server to make PuTTY overrun or underrun buffers and crash. [...] These vulnerabilities can be triggered before host key verification, which means that you are not even safe if you trust the server you think you
    last seen2020-06-01
    modified2020-06-02
    plugin id69250
    published2013-08-08
    reporterThis script is Copyright (C) 2013-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69250
    titleFreeBSD : PuTTY -- Four security holes in versions before 0.63 (4b448a96-ff73-11e2-b28d-080027ef73ec)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2736.NASL
    descriptionSeveral vulnerabilities where discovered in PuTTY, a Telnet/SSH client for X. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2013-4206 Mark Wooding discovered a heap-corrupting buffer underrun bug in the modmul function which performs modular multiplication. As the modmul function is called during validation of any DSA signature received by PuTTY, including during the initial key exchange phase, a malicious server could exploit this vulnerability before the client has received and verified a host key signature. An attack to this vulnerability can thus be performed by a man-in-the-middle between the SSH client and server, and the normal host key protections against man-in-the-middle attacks are bypassed. - CVE-2013-4207 It was discovered that non-coprime values in DSA signatures can cause a buffer overflow in the calculation code of modular inverses when verifying a DSA signature. Such a signature is invalid. This bug however applies to any DSA signature received by PuTTY, including during the initial key exchange phase and thus it can be exploited by a malicious server before the client has received and verified a host key signature. - CVE-2013-4208 It was discovered that private keys were left in memory after being used by PuTTY tools. - CVE-2013-4852 Gergely Eberhardt from SEARCH-LAB Ltd. discovered that PuTTY is vulnerable to an integer overflow leading to heap overflow during the SSH handshake before authentication due to improper bounds checking of the length parameter received from the SSH server. A remote attacker could use this vulnerability to mount a local denial of service attack by crashing the putty client. Additionally this update backports some general proactive potentially security-relevant tightening from upstream.
    last seen2020-03-17
    modified2013-08-13
    plugin id69313
    published2013-08-13
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69313
    titleDebian DSA-2736-1 : putty - several vulnerabilities

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 61649 CVE(CAN) ID: CVE-2013-4207 PuTTY是Windows和Unix平台上的PuTTYTelnet和SSH的实现,带有xterm终端模拟器 PuTTY 0.52 - 0.63在验证DSA签名的模逆计算中存在缓冲区溢出漏洞,攻击者可以使用此漏洞进行拒绝服务攻击甚至执行任意代码 0 Simon Tatham PuTTY 0.52 - 0.63 厂商补丁: Simon Tatham ------------ 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: http://www.chiark.greenend.org.uk/~sgtatham/putty/
idSSV:60945
last seen2017-11-19
modified2013-08-11
published2013-08-11
reporterRoot
titlePuTTY DSA签名远程缓冲区溢出漏洞(CVE-2013-4207)