Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2005-0467

Overview

Vulnerability Score 7.5 7.5
CVE Id CVE-2005-0467
Last Modified 05 Sep 2008 04:46:22
Published 21 Feb 2005 12:00:00
Confidentiality Impact PARTIAL PARTIAL
Integrity Impact PARTIAL PARTIAL
Availability Impact PARTIAL PARTIAL
Access Vector NETWORK
Access Complexity LOW
Authentication NONE

CVE-2005-0467

Summary

Multiple integer overflows in the (1) sftp_pkt_getstring and (2) fxp_readdir_recv functions in the PSFTP and PSCP clients for PuTTY 0.56, and possibly earlier versions, allow remote malicious web sites to execute arbitrary code via SFTP responses that corrupt the heap after insufficient memory has been allocated.

Vulnerable Systems

Application

  • Putty 0.56


References

IDEFENSE - 20050221 Multiple PuTTY SFTP Client Packet Parsing Integer Overflow Vulnerabilities

GENTOO - GLSA-200502-28

SECUNIA - 14333

XF - putty-sftppktgetstring-bo(19403)

CONFIRM - http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-string.html

CONFIRM - http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-readdir.html

CONFIRM - http://www-1.ibm.com/support/docview.wss?uid=ssg1S1002416

CONFIRM - http://www-1.ibm.com/support/docview.wss?uid=ssg1S1002414

SECUNIA - 17214


Last Updated: 27 May 2016 10:39:48