SSH: PuTTY SSH Client RSA Key Exchange Integer Overflow

An integer overflow vulnerability has been reported in PuTTY SSH Client. The vulnerability is due to improper handling of overly short RSA Keys During RSA Key Exchanges. A remote, unauthenticated attacker could exploit this vulnerability by enticing a targeted user to connect to a malicious SSH server. Successful exploitation could result in denial-of-service conditions or, in the worst case, arbitrary code execution.

Extended Description

A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification.

Affected Products

Putty putty

References

CVE: CVE-2019-9894

Short Name

SSH:OVERFLOW:PUTTY-INT-OF

Severity

Major

Recommended

True

Recommended Action

Drop

SSH: PuTTY SSH Client RSA Key Exchange Integer Overflow

Extended Description

Affected Products

References

Found a potential security threat?