Putty SSH2 Authentication Password Persistence Weakness

Bugtraq ID:	6724
Class:	Design Error
CVE:	CVE-2003-0048
Remote:	No
Local:	Yes
Published:	Jan 28 2003 12:00AM
Updated:	Jul 11 2009 08:06PM
Credit:	Discovery credited to Knud Erik Højgaard <[email protected]>.
Vulnerable:	Simon Tatham PuTTY 0.53 b Simon Tatham PuTTY 0.53 Simon Tatham PuTTY 0.49 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 Simon Tatham PuTTY 0.48 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0
Not Vulnerable:

Putty SSH2 Authentication Password Persistence Weakness

It has been reported that Putty does not safely handle password information. As a result, a local user may be able to recover authentication passwords.

Putty SSH2 Authentication Password Persistence Weakness

No exploit is required for this weakness.

Putty SSH2 Authentication Password Persistence Weakness

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Putty SSH2 Authentication Password Persistence Weakness

References:

• PuTTY Homepage (PuTTY Project)
  
• iDEFENSE Security Advisory 01.28.03: SSH2 Clients Insecurely Store Passwords ("iDEFENSE Labs" )