CVE-2017-6542
CriticalSummary
The ssh_agent_channel_data function in PuTTY before version 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message, leading to a buffer overflow.
Risk Assessment
Attackers may exploit this vulnerability to execute remote code or destabilize the system, potentially leading to data loss or unauthorized access.
Recommendation
It is recommended to update PuTTY to version 0.68 or later to mitigate the risks associated with this vulnerability.
Other vulnerabilities in PuTTY
See all- CVE-2026-48852Low
PuTTY versions 0.71 through 0.83 have an assertion failure in ECDSA signature verification. The issue is fixed in version 0.84.
- CVE-2026-48851Low
In PuTTY versions 0.77 through 0.83, the PuTTY icon is used as a trust indicator for TELNET data, but the trust status is not cleared between proxy authentication and the main session.
- CVE-2026-48850Low
PuTTY versions 0.72 through before 0.84 have a double free vulnerability in RSA KEX handling.
Original NVD description (English source)
The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message and leveraging the ability to connect to the Unix-domain socket representing the forwarded agent connection, which trigger a buffer overflow.