Advisories ยป MGASA-2013-0242

Updated putty and filezilla packages fixes security vulnerability

Publication date: 09 Aug 2013
Modification date: 09 Aug 2013
Type: security
Affected Mageia releases : 2 , 3
CVE: CVE-2013-4206 , CVE-2013-4207 , CVE-2013-4208 , CVE-2013-4852

Description

PuTTY versions 0.62 and earlier - as well as all software that
integrates   these versions of PuTTY - are vulnerable to an integer
overflow leading to heap overflow during the SSH handshake before
authentication, caused by improper bounds checking of the length
parameter received from the SSH server. This allows remote attackers
to cause denial of service, and may have more severe impact on the
operation of software that uses PuTTY code (CVE-2013-4852).

PuTTY versions 0.62 and earlier - as well as all software that
integrates these versions of PuTTY - are vulnerable to a heap-corrupting
buffer underrun bug in the modmul function which performs modular
multiplication (CVE-2013-4206).

PuTTY versions 0.62 and earlier - as well as all software that
integrates these versions of PuTTY - are vulnerable to a buffer overflow
vulnerability in the calculation of modular inverses when verifying a
DSA signature (CVE-2013-4207).

PuTTY versions 0.62 and earlier - as well as all software that
integrates these versions of PuTTY - are vulnerable to private keys left
in memory after being used by PuTTY tools (CVE-2013-4208).

References

SRPMS

2/core

3/core