7 ms·

Release Notes: Security fix: an integer overflow bug in the agent forwarding code. See vuln-agent-fwd-overflow. Security fix: the Windows PuTTY binarie

by based2 10y ago

Release Notes: Security fix: an integer overflow bug in the agent forwarding code. See vuln-agent-fwd-overflow. Security fix: the Windows PuTTY binaries should no longer be vulnerable to hijacking by specially named DLLs in the same directory (on versions of Windows where they previously were). See vuln-indirect-dll-hijack. Windows PuTTY no longer sets a restrictive process ACL by default, because this turned out to inconvenience too many legitimate applications such as NVDA and TortoiseGit. You can still manually request a restricted ACL using the command-line option -restrict-acl. The Windows PuTTY tools now come in a 64-bit version. The Windows PuTTY tools now have Windows's ASLR and DEP security features turned on. Support for elliptic-curve cryptography (the NIST curves and 25519), for host keys, user authentication keys, and key exchange. Support for importing and exporting OpenSSH's new private key format. Host key preference policy change: PuTTY prefers host key formats for which it already knows the key. Run-time option (from the system menu / Ctrl-right-click menu) to retrieve other host keys from the same server (which cross-certifies them using the session key established using an already-known key) and add them to the known host-keys database. The Unix GUI PuTTY tools can now be built against GTK 3. There is now a Unix version of Pageant.

JonRB 10y ago
This is the information I came to find. Thanks!
- xs 10y ago
  Why would such a small, simple program need to be 64 bit? Exactly what changes when moving puTTY from 32 bit to 64 bit? It now takes up more memory?
  - rb12345 10y ago
    The most likely reason is ASLR support, since you have more address space available for randomisation. Other than that, you can probably get a slight boost in performance from the differences between x64 and x86, but lose out if the code is particularly pointer-heavy.
  - gfody 10y ago
    We are well beyond moving to 64bit on a needs-only basis. At this point it's about dropping legacy and future proofing. There's also no reason 64bit apps should have a larger memory footprint; the ISA and addressing modes are actually much tidier.
  - executesorder66 10y ago
    Here are the reasons they now provide a 64bit version: http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/win64-binaries.html http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/w...
Cogito 10y ago
Thank so much for posting this. Perchance, could you remove the quote formatting as it makes it nearly impossible to read on mobile?
- 0x0 10y ago
  Or visit the source: http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.ht...
  - Cogito 10y ago
    Thanks, this is probably a better landing page for HN than the linked release page! I had a quick hunt for it but couldn't see it on the release page.
- Cyphase 10y ago
  Security fix: an integer overflow bug in the agent forwarding code. See vuln-agent-fwd-overflow. Security fix: the Windows PuTTY binaries should no longer be vulnerable to hijacking by specially named DLLs in the same directory (on versions of Windows where they previously were). See vuln-indirect-dll-hijack. Windows PuTTY no longer sets a restrictive process ACL by default, because this turned out to inconvenience too many legitimate applications such as NVDA and TortoiseGit. You can still manually request a restricted ACL using the command-line option -restrict-acl. The Windows PuTTY tools now come in a 64-bit version. The Windows PuTTY tools now have Windows's ASLR and DEP security features turned on. Support for elliptic-curve cryptography (the NIST curves and 25519), for host keys, user authentication keys, and key exchange. Support for importing and exporting OpenSSH's new private key format. Host key preference policy change: PuTTY prefers host key formats for which it already knows the key. Run-time option (from the system menu / Ctrl-right-click menu) to retrieve other host keys from the same server (which cross-certifies them using the session key established using an already-known key) and add them to the known host-keys database. The Unix GUI PuTTY tools can now be built against GTK 3. There is now a Unix version of Pageant.
  - 10y ago
MrRadar 10y ago
This release also adds support for the ChaCha20 AEAD cipher and encrypt-then-MAC modes for non-AEAD ciphers. Not sure why those aren't included in the release notes.
zer0t3ch 10y ago
> Support for importing and exporting OpenSSH's new private key format What new private key format is that?
- jwilk 10y ago
  http://www.tedunangst.com/flak/post/new-openssh-key-format-and-bcrypt-pbkdf http://www.tedunangst.com/flak/post/new-openssh-key-format-a...
caf 10y ago
Isn't this "DLL hijacking" thing a bit overblown? The directory an application runs from on Windows has always been considered part of the security perimeter of the application. If you can drop a malicious DLL where putty.exe lives, can't you just drop a malicious putty.exe?
- __jal 10y ago
  Not a windows person, so I can't speak to how the directory is treated, but I've watched enough people run applications from the Downloads directory to wonder about it.
  - beachstartup 10y ago
    with putty i would be surprised if most didn't run it straight from the desktop. i would be a dirty liar if i said i haven't, countless times.
    - monk_e_boy 10y ago
      This. Without an installer that puts a link into the start menu, everyone I've ever worked with just dumps it on the desktop. I used to throw a symlink into the start menu, but when other devs used my machine they expected it to be on the desktop. Just one of those quirks of using PUTTY
      - marvy 10y ago
        But why not just use the installer?
        gasda 10y ago
        I was going to say putty does not have an installer, but TIL putty now has an installer..
        hermitdev 10y ago
        For a long time, there wasn't an installer for putty, so a lot of us became accustomed to just dropping the binary on our desktop or "bin" folder", but there is an installer now. Also, certain corporate environments that preclude the installer from working correctly, but won't mind you "installing" a program to your desktop/local app data.
james_a_craig 10y ago
Buried in the FAQ and not in the changelog for some reason:- As of 0.68, PuTTY will no longer fall back to SSH-1 if the server doesn't appear to support SSH-2; you must explicitly ask for SSH-1.

by based2 10y ago

JonRB 10y ago

This is the information I came to find. Thanks!

xs 10y ago
Why would such a small, simple program need to be 64 bit? Exactly what changes when moving puTTY from 32 bit to 64 bit? It now takes up more memory?
- rb12345 10y ago
  The most likely reason is ASLR support, since you have more address space available for randomisation. Other than that, you can probably get a slight boost in performance from the differences between x64 and x86, but lose out if the code is particularly pointer-heavy.
- gfody 10y ago
  We are well beyond moving to 64bit on a needs-only basis. At this point it's about dropping legacy and future proofing. There's also no reason 64bit apps should have a larger memory footprint; the ISA and addressing modes are actually much tidier.
- executesorder66 10y ago
  Here are the reasons they now provide a 64bit version: http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/win64-binaries.html http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/w...

Cogito 10y ago

Thank so much for posting this. Perchance, could you remove the quote formatting as it makes it nearly impossible to read on mobile?

0x0 10y ago
Or visit the source: http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.ht...
- Cogito 10y ago
  Thanks, this is probably a better landing page for HN than the linked release page! I had a quick hunt for it but couldn't see it on the release page.
Cyphase 10y ago
Security fix: an integer overflow bug in the agent forwarding code. See vuln-agent-fwd-overflow. Security fix: the Windows PuTTY binaries should no longer be vulnerable to hijacking by specially named DLLs in the same directory (on versions of Windows where they previously were). See vuln-indirect-dll-hijack. Windows PuTTY no longer sets a restrictive process ACL by default, because this turned out to inconvenience too many legitimate applications such as NVDA and TortoiseGit. You can still manually request a restricted ACL using the command-line option -restrict-acl. The Windows PuTTY tools now come in a 64-bit version. The Windows PuTTY tools now have Windows's ASLR and DEP security features turned on. Support for elliptic-curve cryptography (the NIST curves and 25519), for host keys, user authentication keys, and key exchange. Support for importing and exporting OpenSSH's new private key format. Host key preference policy change: PuTTY prefers host key formats for which it already knows the key. Run-time option (from the system menu / Ctrl-right-click menu) to retrieve other host keys from the same server (which cross-certifies them using the session key established using an already-known key) and add them to the known host-keys database. The Unix GUI PuTTY tools can now be built against GTK 3. There is now a Unix version of Pageant.
- 10y ago

MrRadar 10y ago

This release also adds support for the ChaCha20 AEAD cipher and encrypt-then-MAC modes for non-AEAD ciphers. Not sure why those aren't included in the release notes.

zer0t3ch 10y ago

> Support for importing and exporting OpenSSH's new private key format What new private key format is that?

jwilk 10y ago
http://www.tedunangst.com/flak/post/new-openssh-key-format-and-bcrypt-pbkdf http://www.tedunangst.com/flak/post/new-openssh-key-format-a...

caf 10y ago

Isn't this "DLL hijacking" thing a bit overblown? The directory an application runs from on Windows has always been considered part of the security perimeter of the application. If you can drop a malicious DLL where putty.exe lives, can't you just drop a malicious putty.exe?

__jal 10y ago
Not a windows person, so I can't speak to how the directory is treated, but I've watched enough people run applications from the Downloads directory to wonder about it.
- beachstartup 10y ago
  with putty i would be surprised if most didn't run it straight from the desktop. i would be a dirty liar if i said i haven't, countless times.
  - monk_e_boy 10y ago
    This. Without an installer that puts a link into the start menu, everyone I've ever worked with just dumps it on the desktop. I used to throw a symlink into the start menu, but when other devs used my machine they expected it to be on the desktop. Just one of those quirks of using PUTTY
    - marvy 10y ago
      But why not just use the installer?
      - gasda 10y ago
        I was going to say putty does not have an installer, but TIL putty now has an installer..
      - hermitdev 10y ago
        For a long time, there wasn't an installer for putty, so a lot of us became accustomed to just dropping the binary on our desktop or "bin" folder", but there is an installer now. Also, certain corporate environments that preclude the installer from working correctly, but won't mind you "installing" a program to your desktop/local app data.

james_a_craig 10y ago

Buried in the FAQ and not in the changelog for some reason:- As of 0.68, PuTTY will no longer fall back to SSH-1 if the server doesn't appear to support SSH-2; you must explicitly ask for SSH-1.