« Volver al listado

CVE-2011-4607

Estado: ModificadaBaja (2.1)—

PuTTY 0.59 through 0.61 does not clear sensitive process memory when managing user replies that occur during keyboard-interactive authentication, which might allow local users to read login passwords by obtaining access to the process' memory.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Putty — Putty

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2011-4607",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.1,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-08-23T16:55:06.907",
  "references": [
    {
      "url": "http://seclists.org/oss-sec/2011/q4/499",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://seclists.org/oss-sec/2011/q4/500",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/password-not-wiped.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://seclists.org/oss-sec/2011/q4/499",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://seclists.org/oss-sec/2011/q4/500",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/password-not-wiped.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "PuTTY 0.59 through 0.61 does not clear sensitive process memory when managing user replies that occur during keyboard-interactive authentication, which might allow local users to read login passwords by obtaining access to the process' memory."
    },
    {
      "lang": "es",
      "value": "PuTTY v0.59 hasta v0.61 no borra la memoria de procesos sensibles en la gestión de las respuestas del usuario que se producen durante la autenticación interactiva por teclado, lo que podría permitir a usuarios locales leer las contraseñas de inicio de sesión mediante la obtención de acceso a la memoria del proceso."
    }
  ],
  "lastModified": "2026-06-16T23:35:08.090",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:putty:putty:0.59:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B33EB10-535F-42F2-8F78-CE128A89447C"
            },
            {
              "criteria": "cpe:2.3:a:putty:putty:0.60:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "218F9EAF-C260-43EC-99C4-EFACA9A1DA8D"
            },
            {
              "criteria": "cpe:2.3:a:putty:putty:0.61:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5966235B-2F1A-45C5-AF65-99FFFE4725DF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}