Unscored severity · published Feb 19, 2003
CVE-2003-0048
PuTTY 0.53b and earlier does not clear logon credentials from memory, including plaintext passwords, which could allow attackers with access to memory to steal the SSH credentials
–
CVSS
0.4%
EPSS
No
On KEV
Description
PuTTY 0.53b and earlier does not clear logon credentials from memory, including plaintext passwords, which could allow attackers with access to memory to steal the SSH credentials.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PU
Putty · Putty
0.48; 0.49; 0.53; 0.53b · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2003-0048
CVE.org
https://www.cve.org/CVERecord?id=CVE-2003-0048
marc.info
http://marc.info/?l=bugtraq&m=104386492422014&w=2
Patch
http://www.idefense.com/advisory/01.28.03.txt
www.securityfocus.com
http://www.securityfocus.com/bid/6724
www.securitytracker.com
http://www.securitytracker.com/id?1006014
More from Putty
9.8
CVE-2019-17067
PuTTY before 0.73 on Windows improperly opens port-forwarding listening sockets, which allows attackers to listen on the same port to steal an incoming connection
9.8
CVE-2019-9898
Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71
9.8
CVE-2019-9895
In PuTTY versions before 0.71 on Unix, a remotely triggerable buffer overflow exists in any kind of server-to-client forwarding
9.8
CVE-2017-6542
The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message and leveraging…
8.1
CVE-2021-36367
PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication response