Bug 1029256 – VUL-0: CVE-2017-6542: putty: Integer overflow in the ssh_agent_channel_data

Bug 1029256 - (CVE-2017-6542) VUL-0: CVE-2017-6542: putty: Integer overflow in the ssh_agent_channel_data

(CVE-2017-6542)
Summary:	VUL-0: CVE-2017-6542: putty: Integer overflow in the ssh_agent_channel_data

Status:	RESOLVED FIXED

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Minor
Target Milestone:	---
Assigned To:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/181642/
Whiteboard:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2017-03-14 06:49 UTC by Victor Pereira
Modified:	2017-03-19 14:07 UTC (History)
CC List:	3 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Victor Pereira 2017-03-14 06:49:39 UTC

It was found that putty is vulnerable to an integer overflow. An attacker could overwrite the heap data with his own if the system has SSH agent forwarding and he is able to connect to the Unix-domain socket representing the forwarded agent connection.

Upstream patch:

https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=4ff22863d895cb7ebfced4cf923a012a614adaa8

References:
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-fwd-overflow.html
https://bugzilla.redhat.com/show_bug.cgi?id=1431716
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-6542

Comment 1 Bernhard Wiedemann 2017-03-15 11:00:44 UTC

This is an autogenerated message for OBS integration:
This bug (1029256) was mentioned in
https://build.opensuse.org/request/show/479460 42.2 / putty
https://build.opensuse.org/request/show/479461 42.1 / putty

Comment 2 Andreas Stieger 2017-03-16 23:10:28 UTC

update running

Comment 3 Andreas Stieger 2017-03-19 09:32:10 UTC

release for leap

Comment 4 Swamp Workflow Management 2017-03-19 14:07:35 UTC

openSUSE-SU-2017:0741-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1029256
CVE References: CVE-2017-6542
Sources used:
openSUSE Leap 42.2 (src):    putty-0.68-12.1
openSUSE Leap 42.1 (src):    putty-0.68-12.1