3 ms·
Yes, they need to compromise the server but they also need to compromise the client. With both compromised they will have the same execution privileges as the o
by frozenport 11y ago
Yes, they need to compromise the server but they also need to compromise the client. With both compromised they will have the same execution privileges as the original Putty.exe, then they will need to ROPgadget? If they have both compromised by the heck do they need to use putty?
- Drdrdrq 11y agoNo, they must control the server, and with that they can compromise the client. Or at least this is how I understand it.
- nitrogen 11y agoAn attacker might just need to get something to show up into a log file that is then viewed using PuTTY. Always escape attacker-controlled data before logging or displaying it.
- frozenport 11y agoOkay, but crashing the client isn't the same thing as compromising the client.
- nitrogen 11y agoFrom the linked page describing the bug: > This might be exploitable if the attacker could arrange for UCSWIDE to be in memory somewhere near a sensitive data structure. Crashes are very frequently capable of being exploited, to the point that every crashing bug should be treated as a security vulnerability. At the very least, it's a DoS.