svn commit: r410519 - head/security/vuxml

Mon Mar 7 12:53:03 UTC 2016

Author: mandree
Date: Mon Mar  7 12:53:01 2016
New Revision: 410519
URL: https://svnweb.freebsd.org/changeset/ports/410519

Log:
  New: remote buffer overflow in PuTTY < 0.67's scp documented
  
  Security:	CVE-2016-2563

Modified:
  head/security/vuxml/vuln.xml

Modified: head/security/vuxml/vuln.xml
==============================================================================

--- head/security/vuxml/vuln.xml	Mon Mar  7 12:49:46 2016	(r410518)
+++ head/security/vuxml/vuln.xml	Mon Mar  7 12:53:01 2016	(r410519)
@@ -58,6 +58,38 @@ Notes:
   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="7f0fbb30-e462-11e5-a3f3-080027ef73ec">
+    <topic>PuTTY - old-style scp downloads may allow remote code execution</topic>
+    <affects>
+      <package>
+	<name>putty</name>
+	<range><lt>0.67</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>Simon G. Tatham reports:</p>
+	<blockquote cite="http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-pscp-sink-sscanf.html">
+	  <p>Many versions of PSCP prior to 0.67 have a stack corruption vulnerability in their treatment of the 'sink' direction (i.e. downloading from server to client) of the old-style SCP protocol.</p>
+	  <p>In order for this vulnerability to be exploited, the user must
+	    connect to a malicious server and attempt to download any file.[...]
+	    you can work around it in a vulnerable PSCP by using the -sftp
+	    option to force the use of the newer SFTP protocol, provided your
+	    server supports that protocol.</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-pscp-sink-sscanf.html</url>
+      <cvename>CVE-2016-2563</cvename>
+      <url>https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-2563</url>
+    </references>
+    <dates>
+      <discovery>2016-02-26</discovery>
+      <entry>2016-03-07</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="12d1b5a6-e39d-11e5-9f77-5453ed2e2b49">
     <topic>websvn -- reflected cross-site scripting</topic>
     <affects>
