Mageia alert MGASA-2013-0242 (putty)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2013-0242: Updated putty and filezilla packages fixes security vulnerability 
Date:
    	     
 
Fri, 9 Aug 2013 19:38:39 +0200
Message-ID:
    	     
 
<20130809173839.E52B5445BA@valstar.mageia.org>
Archive-link:
    	     
 
Article, Thread
              
MGASA-2013-0242 - Updated putty and filezilla packages fixes security vulnerability

Publication date: 09 Aug 2013
URL: http://advisories.mageia.org/MGASA-2013-0242.html
Type: security
Affected Mageia releases: 2, 3
CVE: CVE-2013-4206,
     CVE-2013-4207,
     CVE-2013-4208,
     CVE-2013-4852

Description:
PuTTY versions 0.62 and earlier - as well as all software that
integrates   these versions of PuTTY - are vulnerable to an integer
overflow leading to heap overflow during the SSH handshake before
authentication, caused by improper bounds checking of the length
parameter received from the SSH server. This allows remote attackers
to cause denial of service, and may have more severe impact on the
operation of software that uses PuTTY code (CVE-2013-4852).

PuTTY versions 0.62 and earlier - as well as all software that
integrates these versions of PuTTY - are vulnerable to a heap-corrupting
buffer underrun bug in the modmul function which performs modular
multiplication (CVE-2013-4206).

PuTTY versions 0.62 and earlier - as well as all software that
integrates these versions of PuTTY - are vulnerable to a buffer overflow
vulnerability in the calculation of modular inverses when verifying a
DSA signature (CVE-2013-4207).

PuTTY versions 0.62 and earlier - as well as all software that
integrates these versions of PuTTY - are vulnerable to private keys left
in memory after being used by PuTTY tools (CVE-2013-4208).

References:
- https://bugs.mageia.org/show_bug.cgi?id=10925
- http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlis...
- http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlis...
- http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlis...
- http://www.openwall.com/lists/oss-security/2013/08/06/13
- http://www.search-lab.hu/advisories/secadv-20130722
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4206
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4207
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4208
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4852

SRPMS:
- 3/core/putty-0.63-1.mga3
- 3/core/filezilla-3.7.3-1.mga3
- 2/core/putty-0.63-1.mga2
- 2/core/filezilla-3.7.3-1.mga2