CVE:CVE-2013-4208
CNNVD:CNNVD-201308-119
PuTTY是软件开发者Simon Tatham所研发的一套免费的Telnet、Rlogin和SSH客户端软件。该软件主要用于对Linux系统进行远程管理。
PuTTY 0.62及之前版本中的‘rsa_verify’函数中存在漏洞。该漏洞源于程序没有将使用后的敏感进程内存清除，并且没能够释放含有敏感进程内存的结构。本地攻击者可利用该漏洞发现私有RSA和DSA密钥信息。
solution:Upgrade putty putty to a higher version than 0.45,0.46,0.47,0.48,0.49,0.50,0.51,0.52,0.53b,0.54,0.55,0.56,0.57,0.58,0.59,0.60,0.61,and avoid the version 0.45,0.46,0.47,0.48,0.49,0.50,0.51,0.52,0.53b,0.54,0.55,0.56,0.57,0.58,0.59,0.60,0.61; Upgrade simon_tatham putty to a higher version than 0.62,0.53,and avoid the version (,0.62],0.53