Home
|
FAQ
|
Feedback
|
Licence
|
Updates
|
Mirrors
|
Keys
|
Links
|
Team
Download:
Stable
·
Snapshot
|
Docs
|
Privacy
|
Changes
|
Wishlist
When PuTTY begins an SSH connection, it expects to see a greeting
from the server consisting of a single line of text, along the lines
of "SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.18" or
similar. It buffers this line of text in memory so as to check it
against SSH server implementations known to have bugs it can work
around.
Buffering the line of text until it sees a newline, no matter how long the line might be, means that a malicious server, or a MITM, can simply send unlimited amounts of text without a newline in, and consume all the memory on the client machine. This is a denial of service attack (to other processes on the client machine), albeit at the level of a petty nuisance. So it technically counts as a vulnerability.
Many years ago, a previous limit was deliberately removed, to avoid
having to increase it piecemeal as implementations were found that
exceeded the previous limit. But having no limit at all is also a
problem. In 0.85 the limit has been set to 1024 characters, which is
generous, because section 4.2 specifies a limit of 255.
This technical vulnerability was reported by 'zhangph'.
If you want to comment on this web site, see the
Feedback page.