Unscored severity · published Mar 7, 2007
CVE-2006-7162
PuTTY 0.59 and earlier uses weak file permissions for (1) ppk files containing private keys generated by puttygen and (2) session logs created by putty, which allows local users…
–
CVSS
0.3%
EPSS
No
On KEV
Description
PuTTY 0.59 and earlier uses weak file permissions for (1) ppk files containing private keys generated by puttygen and (2) session logs created by putty, which allows local users to gain sensitive information by reading these files.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PU
Putty · Putty
through 0.59 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-7162
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-7162
Patch
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=400804
Vendor Advisory
http://secunia.com/advisories/24381
More from Putty
9.8
CVE-2019-17067
PuTTY before 0.73 on Windows improperly opens port-forwarding listening sockets, which allows attackers to listen on the same port to steal an incoming connection
9.8
CVE-2019-9898
Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71
9.8
CVE-2019-9895
In PuTTY versions before 0.71 on Unix, a remotely triggerable buffer overflow exists in any kind of server-to-client forwarding
9.8
CVE-2017-6542
The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message and leveraging…
8.1
CVE-2021-36367
PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication response