PuTTY 0.53b and earlier does not clear logon credentials from memory, including plaintext passwords, which could allow attackers with access to memory to steal the SSH credentials.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Putty | Putty | 0.48 (including) | 0.48 (including) |
| Putty | Putty | 0.49 (including) | 0.49 (including) |
| Putty | Putty | 0.53 (including) | 0.53 (including) |
| Putty | Putty | 0.53b (including) | 0.53b (including) |
| Putty | Ubuntu | upstream | * |
References
- http://marc.info/?l=bugtraq\u0026m=104386492422014\u0026w=2
- http://www.idefense.com/advisory/01.28.03.txt
- http://www.securityfocus.com/bid/6724
- http://www.securitytracker.com/id?1006014
- http://marc.info/?l=bugtraq\u0026m=104386492422014\u0026w=2
- http://www.idefense.com/advisory/01.28.03.txt
- http://www.securityfocus.com/bid/6724
- http://www.securitytracker.com/id?1006014