Vulnerabilities > CVE-2013-4208 - Information Exposure vulnerability in multiple products
Attack vector
LOCAL Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
NONE Availability impact
NONE Summary
The rsa_verify function in PuTTY before 0.63 (1) does not clear sensitive process memory after use and (2) does not free certain structures containing sensitive process memory, which might allow local users to discover private RSA and DSA keys.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Subverting Environment Variable Values The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
- Footprinting An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
- Exploiting Trust in Client (aka Make the Client Invisible) An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
- Browser Fingerprinting An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
- Session Credential Falsification through Prediction This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
Nessus
NASL family Windows NASL id WINSCP_5_1_7.NASL description The WinSCP program installed on the remote host is a version prior to 5.1.7. It therefore contains code from PuTTY that is affected by the following vulnerabilities related to PuTTY : - An overflow error exists that allows heap corruption when handling DSA signatures. (CVE-2013-4206) - A buffer overflow error exists related to modular inverse calculation, non-coprime values, and DSA signature verification. (CVE-2013-4207) - An error exists that allows disclosure of private key material. (CVE-2013-4208) last seen 2020-06-01 modified 2020-06-02 plugin id 72389 published 2014-02-07 reporter This script is Copyright (C) 2014-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/72389 title WinSCP < 5.1.7 Multiple Vulnerabilities code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(72389); script_version("1.4"); script_cvs_date("Date: 2018/11/15 20:50:29"); script_cve_id("CVE-2013-4206", "CVE-2013-4207", "CVE-2013-4208"); script_bugtraq_id(61644, 61645, 61649); script_name(english:"WinSCP < 5.1.7 Multiple Vulnerabilities"); script_summary(english:"Checks version of WinSCP."); script_set_attribute(attribute:"synopsis", value: "The remote Windows host has an application installed that is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The WinSCP program installed on the remote host is a version prior to 5.1.7. It therefore contains code from PuTTY that is affected by the following vulnerabilities related to PuTTY : - An overflow error exists that allows heap corruption when handling DSA signatures. (CVE-2013-4206) - A buffer overflow error exists related to modular inverse calculation, non-coprime values, and DSA signature verification. (CVE-2013-4207) - An error exists that allows disclosure of private key material. (CVE-2013-4208)"); script_set_attribute(attribute:"see_also", value:"https://winscp.net/tracker/show_bug.cgi?id=1039"); script_set_attribute(attribute:"see_also", value:"https://winscp.net/eng/docs/history#5.1.7"); # http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-modmul.html script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?20c27652"); # http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-bignum-division-by-zero.html script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e1b0243c"); # http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7bdd07a8"); script_set_attribute(attribute:"solution", value:"Upgrade to WinSCP version 5.1.7 / 5.2.4 beta or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"vuln_publication_date", value:"2013/08/06"); script_set_attribute(attribute:"patch_publication_date", value:"2013/08/14"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/02/07"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:winscp:winscp"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Windows"); script_copyright(english:"This script is Copyright (C) 2014-2018 Tenable Network Security, Inc."); script_dependencies("winscp_installed.nbin"); script_require_keys("installed_sw/WinSCP"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("install_func.inc"); app = 'WinSCP'; fixed_version = '5.1.7 / 5.2.4 beta (5.2.4.3548)'; install = get_single_install(app_name:app, exit_if_unknown_ver:TRUE); version = install['version']; path = install['path']; if ( # < 5.1.7 ver_compare(ver:version, fix:"5.1.7", strict:FALSE) < 0 || # 5.2.x (version =~ "^5\.2\." && ver_compare(ver:version, fix:"5.2.4.3548", strict:FALSE) < 0) ) { port = get_kb_item("SMB/transport"); if (!port) port = 445; if (report_verbosity > 0) { report = '\n Path : ' + path + '\n Installed version : ' + version + '\n Fixed versions : ' + fixed_version + '\n'; security_warning(port:port, extra:report); } else security_warning(port); } else audit(AUDIT_INST_PATH_NOT_VULN, app, version, path);
NASL family Fedora Local Security Checks NASL id FEDORA_2013-14706.NASL description Merge further fixes from PuTTY to address CVE-2013-4206, CVE-2013-4207, CVE-2013-4208 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-08-20 plugin id 69392 published 2013-08-20 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/69392 title Fedora 19 : filezilla-3.7.3-1.fc19 (2013-14706) NASL family Fedora Local Security Checks NASL id FEDORA_2013-14676.NASL description This is an update that fixes several bugs, for details see upstream announcement: http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html This is an update that fixes four CVEs: CVE-2013-4206 CVE-2013-4207 CVE-2013-4208 CVE-2013-4852 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-08-21 plugin id 69411 published 2013-08-21 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69411 title Fedora 18 : putty-0.63-1.fc18 (2013-14676) NASL family Windows NASL id PUTTY_063.NASL description The remote host has an installation of PuTTY version 0.52 or greater but earlier than version 0.63. As such, it is reportedly affected by the following vulnerabilities : - An overflow error exists in the function last seen 2020-06-01 modified 2020-06-02 plugin id 69318 published 2013-08-13 reporter This script is Copyright (C) 2013-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69318 title PuTTY 0.52 to 0.62 Multiple Vulnerabilities NASL family SuSE Local Security Checks NASL id OPENSUSE-2013-650.NASL description FileZilla was updated to version 3.7.3 to add various features, fix bugs and also security issues in the embedded putty ssh client. Full changelog: https://filezilla-project.org/changelog.php - Noteworthy changes : - Apply a fix for a security vulnerability in PuTTY as used in FileZilla to handle SFTP. See CVE-2013-4852 for reference. - Merge further fixes from PuTTY to address CVE-2013-4206, CVE-2013-4207, CVE-2013-4208 - Version bump to 3.7.0.1 - Fix issues with bundled gnutls - Update translations - Update to version 3.7.0. Changes since 3.6.0.2 : - Show total transfer speed as tooltip over the transfer indicators - List supported protocols in tooltip of host field in quickconnect bar - Use TLS instead of the deprecated term SSL - Reworded text when saving of passwords is disabled, do not refer to kiosk mode - Improved usability of Update page in settings dialog - Improve SFTP performance - When navigating to the parent directory, highlight the former child - When editing files, use high priority for the transfers - Add label to size conditions in filter conditions dialog indicating that the unit is bytes - Ignore drag&drop operations where source and target are identical and clarify the wording in some drop error cases - Trim whitespace from the entered port numbers - Slightly darker color of inactive tabs - Ignore .. item in the file list context menus if multiple items are selected - Display TLS version and key exchange algorithm in certificate and encryption details dialog for FTP over TLS connections. - Fix handling of remote paths containing double-quotes - Fix crash when opening local directories in Explorer if the name contained characters not representable in the locale last seen 2020-06-05 modified 2014-06-13 plugin id 75120 published 2014-06-13 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/75120 title openSUSE Security Update : filezilla (openSUSE-SU-2013:1347-1) NASL family Fedora Local Security Checks NASL id FEDORA_2013-14656.NASL description This is an update that fixes many bugs, for details see upstream announcement: http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html This is an update that fixes four CVEs: CVE-2013-4206 CVE-2013-4207 CVE-2013-4208 CVE-2013-4852 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-08-21 plugin id 69410 published 2013-08-21 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69410 title Fedora 19 : putty-0.63-1.fc19 (2013-14656) NASL family Windows NASL id FILEZILLA_373.NASL description The version of FileZilla Client on the remote host is a version prior to 3.7.3. As such, it is affected by multiple vulnerabilities : - A buffer underrun vulnerability exists that occurs when verifying a DSA signature when using SFTP. (CVE-2013-4206) - A remote buffer overflow vulnerability exists that is triggered when processing a specially crafted DSA signature when using SFTP. (CVE-2013-4207) - Multiple information disclosure vulnerabilities exist due to improper cleaning of private keys used in SFTP sessions. An attacker could exploit these issues by tricking a user into connecting to a specially crafted SFTP server. This can lead to code execution, denial of service, and access to sensitive information like SFTP login passwords, obsolete session keys, public-key pass phrases, and the private halves of public keys. (CVE-2013-4208) last seen 2020-06-01 modified 2020-06-02 plugin id 69494 published 2013-08-13 reporter This script is Copyright (C) 2013-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/69494 title FileZilla Client < 3.7.3 Multiple Vulnerabilities NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201309-08.NASL description The remote host is affected by the vulnerability described in GLSA-201309-08 (FileZilla: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in FileZilla. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to connect to a malicious server, resulting in possible arbitrary code execution or a Denial of Service. Additionally, a local attacker could read sensitive memory, potentially resulting in password disclosure. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 69899 published 2013-09-15 reporter This script is Copyright (C) 2013-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/69899 title GLSA-201309-08 : FileZilla: Multiple vulnerabilities NASL family Fedora Local Security Checks NASL id FEDORA_2013-14794.NASL description Merge further fixes from PuTTY to address CVE-2013-4206, CVE-2013-4207, CVE-2013-4208 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-09-30 plugin id 70204 published 2013-09-30 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/70204 title Fedora 18 : filezilla-3.7.3-1.fc18 (2013-14794) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_4B448A96FF7311E2B28D080027EF73EC.NASL description Simon Tatham reports : This [0.63] release fixes multiple security holes in previous versions of PuTTY, which can allow an SSH-2 server to make PuTTY overrun or underrun buffers and crash. [...] These vulnerabilities can be triggered before host key verification, which means that you are not even safe if you trust the server you think you last seen 2020-06-01 modified 2020-06-02 plugin id 69250 published 2013-08-08 reporter This script is Copyright (C) 2013-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69250 title FreeBSD : PuTTY -- Four security holes in versions before 0.63 (4b448a96-ff73-11e2-b28d-080027ef73ec) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-2736.NASL description Several vulnerabilities where discovered in PuTTY, a Telnet/SSH client for X. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2013-4206 Mark Wooding discovered a heap-corrupting buffer underrun bug in the modmul function which performs modular multiplication. As the modmul function is called during validation of any DSA signature received by PuTTY, including during the initial key exchange phase, a malicious server could exploit this vulnerability before the client has received and verified a host key signature. An attack to this vulnerability can thus be performed by a man-in-the-middle between the SSH client and server, and the normal host key protections against man-in-the-middle attacks are bypassed. - CVE-2013-4207 It was discovered that non-coprime values in DSA signatures can cause a buffer overflow in the calculation code of modular inverses when verifying a DSA signature. Such a signature is invalid. This bug however applies to any DSA signature received by PuTTY, including during the initial key exchange phase and thus it can be exploited by a malicious server before the client has received and verified a host key signature. - CVE-2013-4208 It was discovered that private keys were left in memory after being used by PuTTY tools. - CVE-2013-4852 Gergely Eberhardt from SEARCH-LAB Ltd. discovered that PuTTY is vulnerable to an integer overflow leading to heap overflow during the SSH handshake before authentication due to improper bounds checking of the length parameter received from the SSH server. A remote attacker could use this vulnerability to mount a local denial of service attack by crashing the putty client. Additionally this update backports some general proactive potentially security-relevant tightening from upstream. last seen 2020-03-17 modified 2013-08-13 plugin id 69313 published 2013-08-13 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69313 title Debian DSA-2736-1 : putty - several vulnerabilities
Seebug
bulletinFamily | exploit |
description | BUGTRAQ ID: 61644 CVE(CAN) ID: CVE-2013-4208 PuTTY是Windows和Unix平台上的PuTTYTelnet和SSH的实现,带有xterm终端模拟器。 PuTTY 0.52 - 0.63在设计中并没有考虑及时擦除内存中的敏感数据,比如密钥等,恶意攻击者可以从PuTTY内存中或者崩溃DUMP中获得密钥或其它敏感信息。 0 PuTTY 0.52 - 0.63 厂商补丁: Simon Tatham ------------ 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: http://www.chiark.greenend.org.uk/~sgtatham/putty/ |
id | SSV:60946 |
last seen | 2017-11-19 |
modified | 2013-08-11 |
published | 2013-08-11 |
reporter | Root |
title | PuTTY 私钥'putty/sshdss.c' 多个信息泄露漏洞 |
References
- http://lists.opensuse.org/opensuse-updates/2013-08/msg00035.html
- http://secunia.com/advisories/54379
- http://secunia.com/advisories/54533
- http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html
- http://www.debian.org/security/2013/dsa-2736
- http://www.openwall.com/lists/oss-security/2013/08/06/11