Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2019.2766 PuTTY version 0.72 is released 24 July 2019 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: PuTTY Publisher: PuTTY Operating System: Windows UNIX variants (UNIX, Linux, OSX) Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction Denial of Service -- Remote with User Interaction Reduced Security -- Unknown/Unspecified Resolution: Patch/Upgrade Original Bulletin: https://lists.tartarus.org/pipermail/putty-announce/2019/000028.html - --------------------------BEGIN INCLUDED TEXT-------------------- PuTTY version 0.72 is released - ------------------------------ All the pre-built binaries, and the source code, are now available from the PuTTY website at https://www.chiark.greenend.org.uk/~sgtatham/putty/ This is a SECURITY UPDATE, fixing vulnerabilities in the obsolete SSH-1 protocol. It also includes many bug fixes over 0.71. We recommend that everybody update. Vulnerabilities fixed in this release include: - A malicious SSH-1 server could trigger a buffer overrun by sending extremely short RSA keys, or certain bad packet length fields. Either of these could happen before host key verification, so even if you trust the server you *intended* to connect to, you would still be at risk. (However, the SSH-1 protocol is obsolete, and recent versions of PuTTY do not try it by default, so you are only at risk if you work with old servers and have explicitly configured SSH-1.) - If a malicious process found a way to impersonate Pageant, then it could cause an integer overflow in any of the SSH client tools (PuTTY, Plink, PSCP, PSFTP) which accessed the malicious Pageant. Other security-related bug fixes include: - The 'trust sigil' system introduced in PuTTY 0.71 to protect against server spoofing attacks had multiple bugs. Trust sigils were not turned off after login in the SSH-1 and Rlogin protocols, and not turned back on if you used the Restart Session command. Both are now fixed. Other bug fixes include: - Kerberos key exchange could crash at the start of an SSH session in the presence of a third-party Windows provider such as MIT Kerberos for Windows, and could also crash if the server sent an ordinary SSH host key as part of the Kerberos exchange. - In SSH-2 keyboard-interactive authentication, one of the message fields sent by the server (namely the 'instructions' message) was accidentally never displayed to the user. - When using SSH-2 connection sharing, pasting text into a downstream PuTTY window that included a line longer than 16Kb could cause that window's connection to be closed. - When using PSCP in old-fashioned SCP mode, downloading files specified by a wildcard could cause a newline character to be appended to the downloaded file names. Also, using the -p option to preserve file times failed with a spurious error message. - On Windows, the numeric keypad key that should generate '.' or ',' depending on keyboard layout was always generating '.'. - RSA keys generated by PuTTYgen could be 1 bit shorter than requested. (Harmless, but a regression in 0.71 compared to 0.70.) Enjoy using PuTTY! - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBXTfvB2aOgq3Tt24GAQju8A//fQLqIVFvu8wLmvcQeoKmEvOy3iLP7EDh Fec0gz7oQ1e4AqSU1oEFhBN984fOPQI7O9Z8rNDHBl+zr2q9hTqF5aHXi/Jzx8mD qlzNyfjcXf/BZyFBDSCNzCnLDXzMZNmMGSiYW5KWEIFh/mQ+7PLmp7EuF8zR/0bb VXVUsh2eAzC8ZK3QF6R8G+ecNGDFlYa+rrXbJgjDzbmnaDNLCLPUs7uFXE2U7n4k tejiP2U+QZjSzyCf12t7Y3Bf1NqdH3AEp22vrqyZC1p+0bAvwRhH1U5Od/G4xuJY 16OLvCktOvu0a8lLzfTpt9iL5+h6sbf5iRTu961YN2bNaX3wXgxF1CFcLobPgoxV sdNZT9FzY6v2yaCFglF4SHrI9EVNVGW0fH4cbCNcKlLBbfMb3pmVgiVu5RBJ7FdO c9k/KSx8dFMbMNqoPNNjdtBFwS8CWdYST8w8yjaGVvbclB4tSsyeFKu1q+cfWV+I Rnsmt1JbkHJiaBOI0GH0VYegkDANsds6vshOgfW6VTYP3nKePGBBdKY4Ff4dWr9m Nbh9MqQMeYE4rZx1LAbBj4CPK1xNmZy+ZCuin1+wQR+tipIfSyCv2yaEqFIzLMLg apiN/4zmQOFBH+ya/djKKLlhMYrEIHO4rNfxAMmKX7oa+427hMr2VSEw6mClR0rc +ldz3of2IeY= =pBCZ -----END PGP SIGNATURE-----