CVE-2021-36367

Description

PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication response. This makes it easier for an attacker-controlled SSH server to present a later spoofed authentication prompt (that the attacker can use to capture credential data, and use that data for purposes that are undesired by the client user).

CVSS Metrics

• v3.1•HIGH•Score: 8.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
• v2.0•MEDIUM•Score: 5.8AV:N/AC:M/Au:N/C:P/I:P/A:N

EPSS Trends

Current EPSS score: 0.14%• Percentile: 33%

Techniques & Countermeasures

• CWE-345•Insufficient Verification of Data Authenticity

  The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Affected Systems

• putty•putty

  ≤ 0.75

References (4)

• https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
• https://git.tartarus.org/?p=simon/putty.git%3Ba=commit%3Bh=1dc5659aa62848f0aeb5de7bd3839fecc7debefa
• https://www.debian.org/security/2023/dsa-5588
• https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html