CVE-2013-4208

The rsa_verify function in PuTTY before 0.63 (1) does not clear sensitive process memory after use and (2) does not free certain structures containing sensitive process memory, which might allow local users to discover private RSA and DSA keys.

CVSS v2.0 2.1 LOW

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://lists.opensuse.org/opensuse-updates/2013-08/msg00035.html
http://secunia.com/advisories/54379	Vendor Advisory
http://secunia.com/advisories/54533
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html
http://www.debian.org/security/2013/dsa-2736
http://www.openwall.com/lists/oss-security/2013/08/06/11

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:putty:putty:0.45:::::::*
	cpe:2.3:a:putty:putty:0.46:::::::*
	cpe:2.3:a:putty:putty:0.47:::::::*
	cpe:2.3:a:putty:putty:0.48:::::::*
	cpe:2.3:a:putty:putty:0.49:::::::*
	cpe:2.3:a:putty:putty:0.50:::::::*
	cpe:2.3:a:putty:putty:0.51:::::::*
	cpe:2.3:a:putty:putty:0.52:::::::*
	cpe:2.3:a:putty:putty:0.53b:::::::*
	cpe:2.3:a:putty:putty:0.54:::::::*
	cpe:2.3:a:putty:putty:0.55:::::::*
	cpe:2.3:a:putty:putty:0.56:::::::*
	cpe:2.3:a:putty:putty:0.57:::::::*
	cpe:2.3:a:putty:putty:0.58:::::::*
	cpe:2.3:a:putty:putty:0.59:::::::*
	cpe:2.3:a:putty:putty:0.60:::::::*
	cpe:2.3:a:putty:putty:0.61:::::::*
	cpe:2.3:a:simon_tatham:putty::::::::
	cpe:2.3:a:simon_tatham:putty:0.53:::::::*

History

No history.

Information

Published : 2013-08-19 23:55

Updated : 2024-02-04 18:16

NVD link : CVE-2013-4208

Mitre link : CVE-2013-4208

CVE.ORG link : CVE-2013-4208

JSON object : View

Products Affected

putty

putty

simon_tatham

putty

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2013-4208", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-08-19T23:55:08.833", "references": [{"url": "http://lists.opensuse.org/opensuse-updates/2013-08/msg00035.html", "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/54379", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/54533", "source": "secalert@redhat.com"}, {"url": "http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html", "source": "secalert@redhat.com"}, {"url": "http://www.debian.org/security/2013/dsa-2736", "source": "secalert@redhat.com"}, {"url": "http://www.openwall.com/lists/oss-security/2013/08/06/11", "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The rsa_verify function in PuTTY before 0.63 (1) does not clear sensitive process memory after use and (2) does not free certain structures containing sensitive process memory, which might allow local users to discover private RSA and DSA keys."}, {"lang": "es", "value": "La funci\u00f3n rsa_verify en PuTTY anterior a 0.63 (1) no limpia de memoria los procesos sensibles despu\u00e9s de usarlos y (2)no libera determinadas estructuras que contienen procesos sensibles, lo que podr\u00eda permitir a usuarios locales descubrir claves privadas RSA y DSA."}], "lastModified": "2019-03-21T17:04:58.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:putty:putty:0.45:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D5EB349-B1DF-4CF5-9468-37DC66A929C3"}, {"criteria": "cpe:2.3:a:putty:putty:0.46:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF223411-6FA4-43EC-8668-7DB4A98E4DEA"}, {"criteria": "cpe:2.3:a:putty:putty:0.47:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0E87C56-DFD9-45D9-9169-3BB94F647F15"}, {"criteria": "cpe:2.3:a:putty:putty:0.48:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1283B462-042C-4857-A700-4179AAE20E2F"}, {"criteria": "cpe:2.3:a:putty:putty:0.49:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2791C9DD-F55D-4683-85AF-B6814C34EFBF"}, {"criteria": "cpe:2.3:a:putty:putty:0.50:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6D7582C1-AA8E-41E4-9D69-9A18A5B76CB0"}, {"criteria": "cpe:2.3:a:putty:putty:0.51:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC082AE0-C49D-4944-BE76-B751DAD1EF84"}, {"criteria": "cpe:2.3:a:putty:putty:0.52:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "23BAD8E4-2D3A-45EE-A25D-77BD698119BB"}, {"criteria": "cpe:2.3:a:putty:putty:0.53b:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8F7716EC-E0F9-4E50-8351-35D2F248B380"}, {"criteria": "cpe:2.3:a:putty:putty:0.54:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "46C2BD4D-9817-459E-ACF4-9C95233200A2"}, {"criteria": "cpe:2.3:a:putty:putty:0.55:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "22EE5957-76F3-4B20-ADE7-E72D1300A3F0"}, {"criteria": "cpe:2.3:a:putty:putty:0.56:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "826FA7E4-7F48-4D1C-856C-A965527B0950"}, {"criteria": "cpe:2.3:a:putty:putty:0.57:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AA54ADC7-2A36-40DA-8219-DAA31509E534"}, {"criteria": "cpe:2.3:a:putty:putty:0.58:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A14381E-91A1-4902-B409-1281CFA2D561"}, {"criteria": "cpe:2.3:a:putty:putty:0.59:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B33EB10-535F-42F2-8F78-CE128A89447C"}, {"criteria": "cpe:2.3:a:putty:putty:0.60:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "218F9EAF-C260-43EC-99C4-EFACA9A1DA8D"}, {"criteria": "cpe:2.3:a:putty:putty:0.61:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5966235B-2F1A-45C5-AF65-99FFFE4725DF"}, {"criteria": "cpe:2.3:a:simon_tatham:putty:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3A8E4288-5CEA-42F3-BF6A-FE7D78C907C0", "versionEndIncluding": "0.62"}, {"criteria": "cpe:2.3:a:simon_tatham:putty:0.53:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "129133D1-B374-4743-9F52-27D0A9558D17"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}