CVE:CVE-2015-2157
CNNVD:CNNVD-201503-221
PuTTY是软件开发者Simon Tatham所研发的一套免费的Telnet、Rlogin和SSH客户端软件。该软件主要用于对Linux系统进行远程管理。
PuTTY 0.51版本至0.63版本中的‘ssh2_load_userkey’和‘ssh2_save_userkey’函数中存在安全漏洞，该漏洞源于程序没有正确删除内存中的SSH-2私钥。本地攻击者可通过读取内存利用该漏洞获取敏感信息。
solution:Upgrade debian debian_linux to a higher version than 7.0,and avoid the version 7.0; Upgrade fedoraproject fedora to a higher version than 20,22,and avoid the version 20,22; Upgrade opensuse opensuse to a higher version than 13.1,13.2,and avoid the version 13.1,13.2; Upgrade putty putty to a higher version than 0.51,0.52,0.53b,0.54,0.55,0.56,0.57,0.58,0.59,0.60,0.61,0.62,0.63,and avoid the version 0.51,0.52,0.53b,0.54,0.55,0.56,0.57,0.58,0.59,0.60,0.61,0.62,0.63; Upgrade simon_tatham putty to a higher version than 0.53,and avoid the version 0.53