Unscored severity · published Feb 21, 2005
CVE-2005-0467
Multiple integer overflows in the (1) sftp_pkt_getstring and (2) fxp_readdir_recv functions in the PSFTP and PSCP clients for PuTTY 0.56, and possibly earlier versions, allow…
–
CVSS
3.8%
EPSS
No
On KEV
Description
Multiple integer overflows in the (1) sftp_pkt_getstring and (2) fxp_readdir_recv functions in the PSFTP and PSCP clients for PuTTY 0.56, and possibly earlier versions, allow remote malicious web sites to execute arbitrary code via SFTP responses that corrupt the heap after insufficient memory has been allocated.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.8% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PU
Putty · Putty
through 0.56 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-0467
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-0467
Patch
http://secunia.com/advisories/14333
secunia.com
http://secunia.com/advisories/17214
www-1.ibm.com
http://www-1.ibm.com/support/docview.wss?uid=ssg1S1002414
www-1.ibm.com
http://www-1.ibm.com/support/docview.wss?uid=ssg1S1002416
Vendor Advisory
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-readdir.html
Vendor Advisory
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-string.html
More from Putty
9.8
CVE-2019-17067
PuTTY before 0.73 on Windows improperly opens port-forwarding listening sockets, which allows attackers to listen on the same port to steal an incoming connection
9.8
CVE-2019-9898
Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71
9.8
CVE-2019-9895
In PuTTY versions before 0.71 on Unix, a remotely triggerable buffer overflow exists in any kind of server-to-client forwarding
9.8
CVE-2017-6542
The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message and leveraging…
8.1
CVE-2021-36367
PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication response