Author: apo
Date: 2017-06-15 22:00:55 +0000 (Thu, 15 Jun 2017)
New Revision: 52599
Modified:
data/CVE/list
data/dla-needed.txt
Log:
CVE-2017-6542,putty: no-dsa for Wheezy
The issue is only exploitable when SSH agent forwarding is enabled (disabled by
default) AND the attacker has been able to connect to the Unix-domain socket
representing the forwarded agent connection.
Modified: data/CVE/list
===================================================================
--- data/CVE/list 2017-06-15 21:58:54 UTC (rev 52598)
+++ data/CVE/list 2017-06-15 22:00:55 UTC (rev 52599)
@@ -8995,6 +8995,7 @@
CVE-2017-6542 (The ssh_agent_channel_data function in PuTTY before 0.68 allows
remote ...)
- putty 0.67-3 (bug #857642)
[jessie] - putty <no-dsa> (Minor issue)
+ [wheezy] - putty <no-dsa> (Minor issue)
NOTE:
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-fwd-overflow.html
NOTE: Fixed by:
https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=4ff22863d895cb7ebfced4cf923a012a614adaa8
(0.68)
NOTE: Bug only exploitable if SSH agent forwarding enabled (not the
default) and if
Modified: data/dla-needed.txt
===================================================================
--- data/dla-needed.txt 2017-06-15 21:58:54 UTC (rev 52598)
+++ data/dla-needed.txt 2017-06-15 22:00:55 UTC (rev 52599)
@@ -86,12 +86,6 @@
NOTE: 2017-06-01: however I don't know whether pson is the only supported
format
NOTE: 2017-06-01: in this older version of puppet. -- lamby@d.o
--
-putty
- NOTE: 2017-04-14: CVE-2017-6542 is only exploitable by a malicious server
- NOTE: with SSH agent forwarding enabled. In this case, the client is in
- NOTE: serious problem anyway. Backporting the fix is non-trivial. Asked the
- NOTE: putty maintainer for help/advice, but no response yet. -- Jonas Meurer
---
qemu (Guido Günther)
--
qemu-kvm (Guido Günther)
_______________________________________________
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
