PuTTY up to 0.74 on Windows Title denial of service

Summaryinfo

A vulnerability was found in PuTTY up to 0.74 on Windows. It has been classified as problematic. This impacts an unknown function of the component Title Handler. The manipulation leads to denial of service. This vulnerability is documented as CVE-2021-33500. The attack can be initiated remotely. Additionally, an exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in PuTTY up to 0.74 on Windows (Connectivity Software). It has been rated as problematic. This issue affects an unknown code block of the component Title Handler. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability.

The weakness was released 05/22/2021. The advisory is shared at docs.ssh-mitm.at. The identification of this vulnerability is CVE-2021-33500. It demands that the victim is doing some kind of user interaction. Technical details are unknown but a public exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

The exploit is available at github.com. It is declared as proof-of-concept.

Upgrading to version 0.75 eliminates this vulnerability. The upgrade is hosted for download at chiark.greenend.org.uk.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Connectivity Software

Name

• PuTTY

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34
• 0.35
• 0.36
• 0.37
• 0.38
• 0.39
• 0.40
• 0.41
• 0.42
• 0.43
• 0.44
• 0.45
• 0.46
• 0.47
• 0.48
• 0.49
• 0.50
• 0.51
• 0.52
• 0.53
• 0.54
• 0.55
• 0.56
• 0.57
• 0.58
• 0.59
• 0.60
• 0.61
• 0.62
• 0.63
• 0.64
• 0.65
• 0.66
• 0.67
• 0.68
• 0.69
• 0.70
• 0.71
• 0.72
• 0.73
• 0.74

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion