PuTTY vulnerability vuln-sftp-string

Home | Licence | FAQ | Docs | Download | Keys | Links
Mirrors | Updates | Feedback | Changes | Wishlist | Team

Many versions of PSFTP and PSCP prior to 0.57 have a heap corruption vulnerability in their treatment of string fields in the SSH File Transfer Protocol (SFTP).

Since a string field is present in the server's response to the FXP_OPEN request, this vulnerability can be triggered by simply connecting to a malicious SFTP server.

(Note however that the vulnerability kicks in after host key verification, so the host key of the server has to have been accepted to get this far.)

SFTP is always used by PSFTP; it is also used by PSCP if available (depending on server behaviour). It can be used in both SSH-2 and SSH-1 (again, depending on server behaviour). Thus, a malicious server can exploit this in all invocations of PSFTP and PSCP, unless the -scp option is supplied to PSCP.

This bug was discovered by a contributor to iDEFENSE's Vulnerability Contributor Program. Along with `vuln-sftp-readdir', it is documented in iDEFENSE's advisory 02.21.05, mentioned in Secunia's advisory SA14333, and has been assigned CVE ID CAN-2005-0467. It has also been individually assigned OSVDB ID 14003.

Vulnerability details: If a string length that would read off the end of the SFTP packet was supplied, sftp.c:sftp_pkt_getstring() would not return a pointer to the string, but would return the server-supplied string length. fxp_open_recv() would then call mkstr() with that length; with a carefully crafted length field, mkstr() would malloc(0) due to an integer overflow, and then memcpy() data from *NULL to that location, leading to a heap corruption. (The data copied to the heap is not trivially server-controlled, but it can't be ruled out on all platforms.)

Audit trail for this vulnerability.