CVE:CVE-2013-4852
CNNVD:CNNVD-201308-056
PuTTY是软件开发者Simon Tatham所研发的一套免费的Telnet、Rlogin和SSH客户端软件。WinSCP是捷克布拉格经济大学所开发与维护的一套使用SSH的开源图形化SFTP和FTP客户端。
PuTTY 0.62及之前版本，WinSCP 5.1.6之前的版本，以及其它产品中存在整数溢出漏洞。通过在SSH握手期间向RSA密钥签名中加入一个负值，触发基于堆的缓冲区溢出，远程SSH服务器端的攻击者可利用该漏洞造成拒绝服务（崩溃），并有可能在运行PuTTY的程序上执行任意代码。
solution:Upgrade winscp winscp to a higher version than 5.1.5,3.7.6,3.8.2,3.8_beta,4.0.4,4.0.5,4.2.6,4.2.7,4.2.8,4.2.9,4.3.2,4.3.4,4.3.5,4.3.6,4.3.7,4.3.8,4.3.9,4.4.0,5.0:beta,5.0.1:beta,5.0.2:beta,5.0.3:beta,5.0.4:beta,5.0.5:beta,5.0.6:beta,5.0.7:beta,5.0.8:rc,5.0.9:rc,5.1,5.1.1,5.1.2,5.1.3,5.1.4,and avoid the version (,5.1.5],3.7.6,3.8.2,3.8_beta,4.0.4,4.0.5,4.2.6,4.2.7,4.2.8,4.2.9,4.3.2,4.3.4,4.3.5,4.3.6,4.3.7,4.3.8,4.3.9,4.4.0,5.0:beta,5.0.1:beta,5.0.2:beta,5.0.3:beta,5.0.4:beta,5.0.5:beta,5.0.6:beta,5.0.7:beta,5.0.8:rc,5.0.9:rc,5.1,5.1.1,5.1.2,5.1.3,5.1.4; Upgrade debian debian_linux to a higher version than 6.0,7.0,7.1,and avoid the version 6.0,7.0,7.1; Upgrade opensuse opensuse to a higher version than 12.3,and avoid the version 12.3; Upgrade putty putty to a higher version than 0.45,0.46,0.47,0.48,0.49,0.50,0.51,0.52,0.53b,0.54,0.55,0.56,0.57,0.58,0.59,0.60,0.61,2010-06-01:r8967,and avoid the version 0.45,0.46,0.47,0.48,0.49,0.50,0.51,0.52,0.53b,0.54,0.55,0.56,0.57,0.58,0.59,0.60,0.61,2010-06-01:r8967; Upgrade simon_tatham putty to a higher version than 0.62,0.53,and avoid the version (,0.62],0.53