Simon Tatham PuTTY up to 0.55 SSH Connection Attempt Handler unknown vulnerability

VulDB: Simon Tatham PuTTY up to 0.55 SSH Connection Attempt Handler unknown vulnerability

General

scipID: 777
Affected: Simon Tatham PuTTY up to 0.55
Published: 08/04/2004
Risk: critical
Entry: 93.7% complete
Created: 08/04/2004
Updated: 09/03/2012

Summary

A vulnerability, which was classified as critical, was found in Simon Tatham PuTTY up to 0.55. This affects an unknown function of the component SSH Connection Attempt Handler. The impact remains unknown.

The weakness was disclosed 08/04/2004 with Core Security Technologies. The advisory is shared for download at chiark.greenend.org.uk. This vulnerability is uniquely identified as CVE-2004-1440 since 02/13/2005. It is possible to initiate the attack remotely. Technical details are unknown but an exploit is available.

The exploit is shared for download at securityfocus.com. The vulnerability was handled as a non-public zero-day exploit for at least 1 days. The vulnerability scanner Nessus provides a plugin with the ID 14560 (GLSA-200408-04 : PuTTY: Pre-authentication arbitrary code execution), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Gentoo Local Security Checks and running in the context local.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at chiark.greenend.org.uk. A possible mitigation has been published 1 days after the disclosure of the vulnerability. The vulnerability is also documented in the databases at OSVDB (8299), Secunia (SA12212), SecurityFocus (BID 10850) and X-Force (16885). Further details are available at chiark.greenend.org.uk.

CVSS

Base Score: 6.0 (CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P) [?]

Access Vector	Access Complexity	Authentication	Confidentiality	Integrity	Availability
Local	High	Multiple	None	None	None
Adjacent	Medium	Single	Partial	Partial	Partial
Network	Low	None	Complete	Complete	Complete

Exploiting

Local: No
Remote: Yes

Availability: Yes
Download: securityfocus.com

Nessus ID: 14560
Nessus Name: GLSA-200408-04 : PuTTY: Pre-authentication arbitrary code execution
Nessus Family: Gentoo Local Security Checks
Nessus Context: local