CVE-2013-4208

The rsa_verify function in PuTTY before 0.63 (1) does not clear sensitive process memory after use and (2) does not free certain structures containing sensitive process memory, which might allow local users to discover private RSA and DSA keys.

CVSS v2.0 2.1 LOW

2.1^/10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html
http://www.debian.org/security/2013/dsa-2736
http://www.openwall.com/lists/oss-security/2013/08/06/11
http://secunia.com/advisories/54379	Vendor Advisory
http://lists.opensuse.org/opensuse-updates/2013-08/msg00035.html
http://secunia.com/advisories/54533

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:putty:putty:0.54:::::::*
	cpe:2.3:a:putty:putty:0.53b:::::::*
	cpe:2.3:a:simon_tatham:putty:0.53:::::::*
	cpe:2.3:a:putty:putty:0.52:::::::*
	cpe:2.3:a:putty:putty:0.61:::::::*
	cpe:2.3:a:simon_tatham:putty::::::::
	cpe:2.3:a:putty:putty:0.60:::::::*
	cpe:2.3:a:putty:putty:0.59:::::::*
	cpe:2.3:a:putty:putty:0.47:::::::*
	cpe:2.3:a:putty:putty:0.46:::::::*
	cpe:2.3:a:putty:putty:0.45:::::::*
	cpe:2.3:a:putty:putty:0.50:::::::*
	cpe:2.3:a:putty:putty:0.49:::::::*
	cpe:2.3:a:putty:putty:0.51:::::::*
	cpe:2.3:a:putty:putty:0.55:::::::*
	cpe:2.3:a:putty:putty:0.48:::::::*
	cpe:2.3:a:putty:putty:0.56:::::::*
	cpe:2.3:a:putty:putty:0.57:::::::*
	cpe:2.3:a:putty:putty:0.58:::::::*

Information

Published : 2013-08-19 16:55

Updated : 2019-03-21 10:04

NVD link : CVE-2013-4208

Mitre link : CVE-2013-4208

JSON object : View

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

Products Affected

simon_tatham

putty

putty

putty

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html", "name": "http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.debian.org/security/2013/dsa-2736", "name": "DSA-2736", "tags": [], "refsource": "DEBIAN"}, {"url": "http://www.openwall.com/lists/oss-security/2013/08/06/11", "name": "[oss-security] 20130806 CVE request: three additional flaws fixed in putty 0.63", "tags": [], "refsource": "MLIST"}, {"url": "http://secunia.com/advisories/54379", "name": "54379", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://lists.opensuse.org/opensuse-updates/2013-08/msg00035.html", "name": "openSUSE-SU-2013:1347", "tags": [], "refsource": "SUSE"}, {"url": "http://secunia.com/advisories/54533", "name": "54533", "tags": [], "refsource": "SECUNIA"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The rsa_verify function in PuTTY before 0.63 (1) does not clear sensitive process memory after use and (2) does not free certain structures containing sensitive process memory, which might allow local users to discover private RSA and DSA keys."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-200"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2013-4208", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "LOW", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2013-08-19T23:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:putty:putty:0.54:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:putty:putty:0.53b:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:simon_tatham:putty:0.53:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:putty:putty:0.52:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:putty:putty:0.61:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:simon_tatham:putty:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "0.62"}, {"cpe23Uri": "cpe:2.3:a:putty:putty:0.60:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:putty:putty:0.59:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:putty:putty:0.47:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:putty:putty:0.46:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:putty:putty:0.45:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:putty:putty:0.50:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:putty:putty:0.49:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:putty:putty:0.51:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:putty:putty:0.55:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:putty:putty:0.48:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:putty:putty:0.56:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:putty:putty:0.57:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:putty:putty:0.58:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2019-03-21T17:04Z"}

2.1 /10