CVE-2005-0467
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
21/02/2005
Last modified:
03/04/2025
Description
Multiple integer overflows in the (1) sftp_pkt_getstring and (2) fxp_readdir_recv functions in the PSFTP and PSCP clients for PuTTY 0.56, and possibly earlier versions, allow remote malicious web sites to execute arbitrary code via SFTP responses that corrupt the heap after insufficient memory has been allocated.
Impact
Base Score 2.0
7.50
Severity 2.0
HIGH
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:putty:putty:*:*:*:*:*:*:*:* | 0.56 (including) |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- http://secunia.com/advisories/14333
- http://secunia.com/advisories/17214
- http://www-1.ibm.com/support/docview.wss?uid=ssg1S1002414
- http://www-1.ibm.com/support/docview.wss?uid=ssg1S1002416
- http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-readdir.html
- http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-string.html
- http://www.gentoo.org/security/en/glsa/glsa-200502-28.xml
- http://www.idefense.com/application/poi/display?id=201&type=vulnerabilities
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19403
- http://secunia.com/advisories/14333
- http://secunia.com/advisories/17214
- http://www-1.ibm.com/support/docview.wss?uid=ssg1S1002414
- http://www-1.ibm.com/support/docview.wss?uid=ssg1S1002416
- http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-readdir.html
- http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-string.html
- http://www.gentoo.org/security/en/glsa/glsa-200502-28.xml
- http://www.idefense.com/application/poi/display?id=201&type=vulnerabilities
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19403