地图 / Heap overflow happen when receiving short length key from ssh server using ssh protocol 1

Heap overflow happen when receiving short length key from ssh server using ssh protocol 1

内存破坏 / 堆溢出 / #630462

厂商: PuTTY (European Commission - DIGIT)
严重程度: 中危 · CVSS 8.2
赏金: $3,646
弱点: 堆溢出
研究员: @hey2baby
披露日期: 2019-09-20
资产: https://www.chiark.greenend.org.uk/~sgtatham/putty/
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（4025 字符中的一小部分）

Summary: There's no check in `ssh1_login_process_queue` function when read `servkey` and `hostkey` length from packet which may cause heap overflow. Remote code execution may be possible.

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 PuTTY (European Commission - DIGIT) 所有。

时间线

2019-06-27报告提交
2019-09-20公开披露

阅读 HackerOne 原文 ↗作者 @hey2baby · 版权归作者与 PuTTY (European Commission - DIGIT) 所有

同类报告

Remote kernel heap overflowPlayStation · 2022-05-11 CVE-2023-38545: socks5 heap buffer overflowcurl · 2023-10-11 [3DS][SSL][SDK] Unchecked number of audio channels in Mobiclip SDK leads to RCE in eShop movie playerNintendo · 2020-12-18 Buffer Overflow Vulnerability in WebSocket Handlingcurl · 2024-01-02 Buffer overflow in req_parsebody method in lua_request.cInternet Bug Bounty · 2022-01-04 PHP mbstring / Oniguruma multiple remote heap/stack corruptionsInternet Bug Bounty · 2019-10-14 · $1,500