Vulnerability Details : CVE-2015-2157
The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.
Vulnerability category: Information leak
Products affected by CVE-2015-2157
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.53b:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.51:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.54:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.52:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.55:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.61:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.60:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.59:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.58:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.57:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.56:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.62:*:*:*:*:*:*:*
- cpe:2.3:a:putty:putty:0.63:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
- cpe:2.3:a:simon_tatham:putty:0.53:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-2157
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 6 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-2157
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
2.1
|
LOW | AV:L/AC:L/Au:N/C:P/I:N/A:N |
3.9
|
2.9
|
NIST |
CWE ids for CVE-2015-2157
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-2157
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151790.html
[SECURITY] Fedora 22 Update: putty-0.64-1.fc22
-
http://www.openwall.com/lists/oss-security/2015/02/28/5
oss-security - Re: CVE Request: PuTTY fails to clear private key information from memory
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151933.html
[SECURITY] Fedora 21 Update: putty-0.64-1.fc21
-
http://www.securityfocus.com/bid/72825
PuTTY CVE-2015-2157 Local Information Disclosure Vulnerability
-
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped-2.html
PuTTY vulnerability private-key-not-wiped-2Patch;Vendor Advisory
-
http://www.openwall.com/lists/oss-security/2015/02/28/4
oss-security - CVE Request: PuTTY fails to clear private key information from memory
-
http://www.debian.org/security/2015/dsa-3190
Debian -- Security Information -- DSA-3190-1 putty
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151839.html
[SECURITY] Fedora 20 Update: putty-0.64-1.fc20
-
http://lists.opensuse.org/opensuse-updates/2015-03/msg00032.html
openSUSE-SU-2015:0474-1: moderate: Security update for putty
-
http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
PuTTY Change LogPatch;Vendor Advisory
Jump to