[arch-security] [ASA-201511-7] putty: arbitrary code execution

[Levente Polyak]

Arch Linux Security Advisory ASA-201511-7
=========================================

Severity: Medium
Date    : 2015-11-12
CVE-ID  : CVE-2015-5309
Package : putty
Type    : arbitrary code execution
Remote  : No
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package putty before version 0.66-1 is vulnerable to an integer
overflow that results in denial of service or, under certain
circumstances, could potentially lead to arbitrary code execution.

Resolution
==========

Upgrade to 0.66-1.

# pacman -Syu "putty>=0.66-1"

The problem has been fixed upstream in version 0.66.

Workaround
==========

None.

Description
===========

A potential memory-corrupting integer overflow has been discovered in
the handling of the ECH (erase characters) control sequence in the
terminal emulator.

To exploit a vulnerability in the terminal emulator, an attacker must be
able to insert a carefully crafted escape sequence into the terminal
stream. For a PuTTY SSH session, this must be before encryption, so the
attacker likely needs access to the server you're connecting to. For
instance, an attacker on a multi-user machine that you connect to could
trick you into running cat on a file they control containing a malicious
escape sequence. (Unix write(1) is not a vector for this, if implemented
correctly.)

The purpose of ECH is to erase multiple characters within a single line.
To this end, it includes a numeric parameter to specify the number of
characters to be erased. PuTTY accumulates this one digit at a time in
an integer variable. As part of the processing of ECH, the
check_boundary function checks whether the start or end of the erased
range falls in the middle of a double-width character (such as a kanji
ideograph) so that it can ensure that the whole character is erased.
Each character cell in the live terminal is held as a structure
containing among other things the character code and a word of
attributes. A double-width character is recorded by having a special
value called UCSWIDE as the character code in the second cell, and when
check_boundary detects that value, it resets the character code of both
cells to a fixed value and copies the attributes from the left one to
the right one.

The vulnerability arises because PuTTY uses signed integer variables to
hold the number of characters to be erased and doesn't adequately check
for overflow. This means that by passing a very large parameter to ECH,
an attacker could cause check_boundary to inspect memory outside the
terminal buffer. Were it to find UCSWIDE there, it would corrupt some
nearby memory. This might be exploitable if the attacker could arrange
for UCSWIDE to be in memory somewhere near a sensitive data structure.

Impact
======

An attacker is able to prepare a specially crafted file and trick the
victim on the same local machine to output the malicious escape sequence
(for example via cat) to trigger an integer overflow that is resulting
in memory corruption ultimately leading to either denial of service or,
under certain circumstances, potentially arbitrary code execution.

References
==========

https://access.redhat.com/security/cve/CVE-2015-5309
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20151112/7acccab6/attachment.asc>