PuTTY Modpow Integer Handling Memory Corruption Vulnerability

BID:10850

Info

PuTTY Modpow Integer Handling Memory Corruption Vulnerability

Bugtraq ID: 10850
Class: Boundary Condition Error
CVE:
Remote: Yes
Local: No
Published: Aug 04 2004 12:00AM
Updated: Aug 04 2004 12:00AM
Credit: Discovery of this issue is credited to Core Security Technologies.
Vulnerable: WinSCP WinSCP 3.6.6
WinSCP WinSCP 3.6.5 Beta
WinSCP WinSCP 3.6.1
WinSCP WinSCP 3.6
WinSCP WinSCP 3.5.6
WinSCP WinSCP 3.5.5 Beta
WinSCP WinSCP 2.0 .0
Simon Tatham PuTTY 0.54
Simon Tatham PuTTY 0.53 b
Simon Tatham PuTTY 0.53
Simon Tatham PuTTY 0.52
Simon Tatham PuTTY 0.51
Simon Tatham PuTTY 0.50
Simon Tatham PuTTY 0.49
- Microsoft Windows 2000 Professional
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows NT 4.0
 Simon Tatham PuTTY 0.48
- Microsoft Windows 2000 Professional
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows NT 4.0
Not Vulnerable: WinSCP WinSCP 3.6.7
Simon Tatham PuTTY 0.55

Discussion

PuTTY Modpow Integer Handling Memory Corruption Vulnerability

Reportedly PuTTY is affected by a remote, pre-authentication code execution vulnerability.

An attacker might leverage this issue to execute arbitrary code on an affected system. As this issue is exploitable before any authorization and before the host key is verified, any remote attacker can exploit this to gain unauthorized access to a vulnerable computer with the privileges of the user that started the affected application.

Exploit / POC

PuTTY Modpow Integer Handling Memory Corruption Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

PuTTY Modpow Integer Handling Memory Corruption Vulnerability

Solution:
WinSCP has released an upgrade to address this issue in affected WinSCp versions.

Gentoo has released updates for this issue that may be applied with the following commands:
emerge sync
emerge -pv ">=net-misc/putty-0.55"
emerge ">=net-misc/putty-0.55"

The vendor has provided an upgrade dealing with this issue.


Simon Tatham PuTTY 0.48

Simon Tatham PuTTY 0.49

Simon Tatham PuTTY 0.50

Simon Tatham PuTTY 0.51

Simon Tatham PuTTY 0.52

Simon Tatham PuTTY 0.53

Simon Tatham PuTTY 0.53 b

Simon Tatham PuTTY 0.54

WinSCP WinSCP 2.0 .0

WinSCP WinSCP 3.5.5 Beta

WinSCP WinSCP 3.5.6

WinSCP WinSCP 3.6

WinSCP WinSCP 3.6.1

WinSCP WinSCP 3.6.5 Beta

WinSCP WinSCP 3.6.6

References

PuTTY Modpow Integer Handling Memory Corruption Vulnerability

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report