NetSight
IP …
medium6.8

CVE-2013-4852

Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (cras…

Impact

Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the SSH handshake, which triggers a heap-based buffer overflow.

Affected products

VendorProductAffected versions
WinscpWinscp
through 5.1.5
Versions 3.7.6, 3.8.2, 3.8_beta, 4.0.4, 4.0.5
DebianDebian Linux
Versions 6.0, 7.0, 7.1
OpensuseOpensuse
Version 12.3
PuttyPutty
Versions 0.45, 0.46, 0.47, 0.48, 0.49, 0.50
Simon TathamPutty
through 0.62
Version 0.53

Weakness classification

CWE-189

References