CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
AI Score
Confidence
Low
EPSS
Percentile
5.1%
The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.
Vendor | Product | Version | CPE |
---|---|---|---|
debian | debian_linux | 7.0 | cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* |
fedoraproject | fedora | 20 | cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:* |
fedoraproject | fedora | 22 | cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:* |
opensuse | opensuse | 13.1 | cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:* |
opensuse | opensuse | 13.2 | cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:* |
putty | putty | 0.51 | cpe:2.3:a:putty:putty:0.51:*:*:*:*:*:*:* |
putty | putty | 0.52 | cpe:2.3:a:putty:putty:0.52:*:*:*:*:*:*:* |
putty | putty | 0.53b | cpe:2.3:a:putty:putty:0.53b:*:*:*:*:*:*:* |
putty | putty | 0.54 | cpe:2.3:a:putty:putty:0.54:*:*:*:*:*:*:* |
putty | putty | 0.55 | cpe:2.3:a:putty:putty:0.55:*:*:*:*:*:*:* |
lists.fedoraproject.org/pipermail/package-announce/2015-March/151790.html
lists.fedoraproject.org/pipermail/package-announce/2015-March/151839.html
lists.fedoraproject.org/pipermail/package-announce/2015-March/151933.html
lists.opensuse.org/opensuse-updates/2015-03/msg00032.html
www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped-2.html
www.debian.org/security/2015/dsa-3190
www.openwall.com/lists/oss-security/2015/02/28/4
www.openwall.com/lists/oss-security/2015/02/28/5
www.securityfocus.com/bid/72825