CVE-2017-6542

Critical

Published: 27/03/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The ssh_agent_channel_data function in PuTTY before version 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message, leading to a buffer overflow.

Risk Assessment

Attackers may exploit this vulnerability to execute remote code or destabilize the system, potentially leading to data loss or unauthorized access.

Recommendation

It is recommended to update PuTTY to version 0.68 or later to mitigate the risks associated with this vulnerability.

Original NVD description (English source)

The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message and leveraging the ability to connect to the Unix-domain socket representing the forwarded agent connection, which trigger a buffer overflow.