Vulnerability Details : CVE-2013-4852
Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the SSH handshake, which triggers a heap-based buffer overflow.
Vulnerability category: OverflowExecute codeDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2013-4852
Probability of exploitation activity in the next 30 days: 2.72%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 89 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2013-4852
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
CWE ids for CVE-2013-4852
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-4852
-
http://www.search-lab.hu/advisories/secadv-20130722
PuTTY SSH handshake heap overflow (CVE-2013-4852) - SEARCH-LAB
-
http://winscp.net/tracker/show_bug.cgi?id=1017
Bug 1017 – SSH vulnerability :: Tracker :: WinSCP
-
http://www.debian.org/security/2013/dsa-2736
Debian -- Security Information -- DSA-2736-1 putty
-
http://lists.opensuse.org/opensuse-updates/2013-08/msg00041.html
openSUSE-SU-2013:1355-1: moderate: update for putty
-
http://lists.opensuse.org/opensuse-updates/2013-08/msg00035.html
openSUSE-SU-2013:1347-1: moderate: filezilla: 3.7.3 version and security
-
http://svn.tartarus.org/sgt?view=revision&sortby=date&revision=9896
-
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-signature-stringlen.html
PuTTY vulnerability vuln-signature-stringlenVendor Advisory
-
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718779
#718779 - putty: CVE-2013-4852 - Debian Bug report logs
Products affected by CVE-2013-4852
- cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.48:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.49:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.53b:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.50:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.51:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.54:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.52:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.55:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.61:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.60:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.59:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.58:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.57:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.45:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.47:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.56:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.46:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:2010-06-01:r8967:*:*:development_snapshot:*:*:*
- cpe:2.3:a:winscp:winscp:*:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:3.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.3.8:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.3.7:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:3.7.6:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.0.6:beta:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.0.5:beta:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.0.4:beta:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.0.3:beta:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.0.2:beta:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.2.9:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.0.9:rc:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.0.7:beta:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.0:beta:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.3.9:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.1:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.0.8:rc:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:5.0.1:beta:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:3.8_beta:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:winscp:winscp:4.3.5:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*
- cpe:2.3:a:simon_tatham:putty:*:*:*:*:*:*:*:*
- cpe:2.3:a:simon_tatham:putty:0.53:*:*:*:*:*:*:*