7 ms·

PuTTY 0.63 released, fixing four security holes

138 points by bwblabs 13y ago

VMG 13y ago
Is there a client that has UTF8 as default and something different than the courier font?
- gcb0 13y ago
  It's two clicks after you install putty. select Default, go change those two options (recommend the Mensch font, but that's purely personal). Go back to the sessions screen, save this as default. done. now every session you create will have UTF8 and a decent font by default. I also suggest you change scroll back to 999 or 9999. And change the color of bold blue to something readable.
  - VMG 13y ago
    Those are actually more than two clicks and sadly enough to frustrate me every time. There must be a fork with sane defaults out there somewhere.
    - eli 13y ago
      You could probably export a Registry file that has all your settings and then import on a new machine.
      - foolfoolz 13y ago
        if you are a putty user, do this. its very time consuming to set up putty especially colors but its easy to keep all your settings in a reg file.
      - e12e 13y ago
        The last time I used windows a bit (I think it was around the Planetside 2 launch...), I noted down this: # set up for putty: # From: http://mshnitzer.wordpress.com/2009/10/09/export-putty-settings-with-a-single-command/ http://mshnitzer.wordpress.com/2009/10/09/export-putty-setti... comment: reg export HKCU\Software\SimonTatham putty.reg reg import putty.reg I'm not sure what's the standard now, but I also always set "use ssh protocol v2 only" -- and you probably should too (on the off chance that you have some ancient device that doesn't handle version 2, you should probably make an exception in that profile).
    - voltagex_ 13y ago
      The fork I'm just about to patch is FuTTY - https://github.com/FireEgl/FuTTY https://github.com/FireEgl/FuTTY which includes save-settings-to-file. The screen resizing behaviour (as a result of Screen's +flow command) might drive you crazy though.
  - bwblabs 13y ago
    PuTTY beta 0.63 defaults to UTF-8 encoding and 2000 lines of scrollback (rather than ISO 8859-1 and 200).
- Mindless2112 13y ago
  UTF-8 is the default as of v0.63 [1]. [1] http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.ht...
bwblabs 13y ago
Some other projects who depend on PuTTY like FileZilla have new builds too: https://filezilla-project.org/ https://filezilla-project.org/
caoimhin 13y ago
It's 2013. Why the fuck is anyone still using Windows?
- nucleardog 13y ago
  What does that have to do with anything? PuTTY is not windows-exclusive.
  - barbs 13y ago
    What are the benefits of using PuTTY over plain ssh in a *NIX environment?
    - eru 13y ago
      Putty has nice nethack support.
      - caf 13y ago
        You can also run nethack under 'cp437' (https://github.com/keaston/cp437 https://github.com/keaston/cp437) to use the IBMGraphics option on a UTF-8 terminal like gnome-terminal.
  - tene 13y ago
    Putty on linux has been very useful to me several times, when preparing screenshots for documentation for windows users.
- JohnTHaller 13y ago
  Because most of the world's work is still done on Windows.
- tigerweeds 13y ago
  just out of curiosity: what are you using?
- induscreep 13y ago
jontro 13y ago
The security holes are not critical but of course you should upgrade anyways. 3 of the holes have the following notice: We are currently unaware of any way in which this can lead to remote code execution. 4th hole is that putty does not cleanup sensitive memory when it could.
- gcb0 13y ago
  3 better-safe-than-sorry-in-improbably-scenario ones and one that requires an attacker to have physical access to your machine (or just to your memory and a good freezer, if you remember that hack hack :) Seems like the best time to upgrade is in a few weeks after the crypto community had some time to analyse the changes. Maybe upgrading in a rush is as bad nowadays than not upgrading, with all the ... terrorism?... going on.
randallsquared 13y ago
Since starting to use Windows 8, I found that the grouping behavior of the taskbar combined with a dozen open PuTTY windows drove me insane. There's a multiple-tabbed PuTTY shell, but it was hard to get used to as well. I finally switched to the Chrome SSH client, which has been much better (though it doesn't have nearly the features of PuTTY, of course).
- fsckin 13y ago
  If you've got a dozen open PuTTY windows, you should really look at SecureCRT. Tabbed sessions, tiling, configurable keyboard/mouse shortcuts, password encryption/automatic session login and best of all, scripting support for Perl/Python. It's $99, but I've easily saved 1000x that amount by being able to quickly script shell interactions that don't easily lend themselves to the regular scripting tools like 'expect'. I think the best example was where a distributed cache cluster was dirtied during a deployment. Dumping the entire 100TB+ of good data was not an option, it would have taken days to warm back up. The cache admin tool had a menu system and wouldn't buffer input, so I couldn't just dump a buffer of commands into it and wait for it to finish. I was able to lookup recently accessed DB rows in SSH tab #1, compare them to the cache in tab #2, and invalidate in another in tab #3. Problem solved in <20 minutes. We eventually built an app to invalidate dirty cached results, but that took about a week to do it the right way.
  - gcb0 13y ago
    yeah, because managing windows is not the problem a window manager would be responsible for... what then? you have a dozen word documents? and a dozen text files? and a dozen images? ... do you keep changing your tools everytime you pass a window number threshold? just get rid of windows 8. as troll as this comment may sound...
    - taspeotis 13y ago
      just get rid of windows 8 I'm not aware of the grouping functionality changing between 7 to 8, at least to the extent that 8 doesn't group more aggressively than 7. In both operating systems you can customise whether applications are grouped or not. And although it's not necessarily PuTTY's job to change because of a new feature in the OS (taskbar grouping), I'd note that there is an API for controlling it [1]. [1] http://blogs.msdn.com/b/oldnewthing/archive/2012/08/20/10341464.aspx http://blogs.msdn.com/b/oldnewthing/archive/2012/08/20/10341...
megaman821 13y ago
As an alternative to PuTTY, MinGW with the OpenSSH package has been great.
voltagex_ 13y ago
I wonder if the diff will apply cleanly to Futty/PuTTYTray - they're still based on a 2012 build of 0.62. Edit: Blergh, SVN.
ereckers 13y ago
I was using Putty Connection Manager (puttycm) to allow for tabbed browsing of multiple windows, and after upgrading Putty I now get issues. Loads nothing but a grey screen. I'm working my way through it, but just wanted to pop in to see if anyone else had an issue. Circling back. Here's the solution: => open Putty Connection Manager => select Tools > Options => select Plugins > Putty => select "Enable additional timing for PuTTY capture (ms): set to 300ms => select Apply & OK
georgiecasey 13y ago
If anyone is looking for a Putty alternative, check out ZOC. It's great but it costs money.
ilikejam 13y ago
PuTTY's pretty much relegated to the emergency usb key these days. Runs on pretty much any Windows and without installing, but not really ideal for heavy use imho. Cygwin + urxvt + clusterssh is the choice of Windows-mandated champions.

138 points by bwblabs 13y ago

VMG 13y ago

Is there a client that has UTF8 as default and something different than the courier font?

gcb0 13y ago
It's two clicks after you install putty. select Default, go change those two options (recommend the Mensch font, but that's purely personal). Go back to the sessions screen, save this as default. done. now every session you create will have UTF8 and a decent font by default. I also suggest you change scroll back to 999 or 9999. And change the color of bold blue to something readable.
- VMG 13y ago
  Those are actually more than two clicks and sadly enough to frustrate me every time. There must be a fork with sane defaults out there somewhere.
  - eli 13y ago
    You could probably export a Registry file that has all your settings and then import on a new machine.
    - foolfoolz 13y ago
      if you are a putty user, do this. its very time consuming to set up putty especially colors but its easy to keep all your settings in a reg file.
    - e12e 13y ago
      The last time I used windows a bit (I think it was around the Planetside 2 launch...), I noted down this: # set up for putty: # From: http://mshnitzer.wordpress.com/2009/10/09/export-putty-settings-with-a-single-command/ http://mshnitzer.wordpress.com/2009/10/09/export-putty-setti... comment: reg export HKCU\Software\SimonTatham putty.reg reg import putty.reg I'm not sure what's the standard now, but I also always set "use ssh protocol v2 only" -- and you probably should too (on the off chance that you have some ancient device that doesn't handle version 2, you should probably make an exception in that profile).
  - voltagex_ 13y ago
    The fork I'm just about to patch is FuTTY - https://github.com/FireEgl/FuTTY https://github.com/FireEgl/FuTTY which includes save-settings-to-file. The screen resizing behaviour (as a result of Screen's +flow command) might drive you crazy though.
- bwblabs 13y ago
  PuTTY beta 0.63 defaults to UTF-8 encoding and 2000 lines of scrollback (rather than ISO 8859-1 and 200).
Mindless2112 13y ago
UTF-8 is the default as of v0.63 [1]. [1] http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.ht...

bwblabs 13y ago

Some other projects who depend on PuTTY like FileZilla have new builds too: https://filezilla-project.org/ https://filezilla-project.org/

caoimhin 13y ago

It's 2013. Why the fuck is anyone still using Windows?

nucleardog 13y ago
What does that have to do with anything? PuTTY is not windows-exclusive.
- barbs 13y ago
  What are the benefits of using PuTTY over plain ssh in a *NIX environment?
  - eru 13y ago
    Putty has nice nethack support.
    - caf 13y ago
      You can also run nethack under 'cp437' (https://github.com/keaston/cp437 https://github.com/keaston/cp437) to use the IBMGraphics option on a UTF-8 terminal like gnome-terminal.
- tene 13y ago
  Putty on linux has been very useful to me several times, when preparing screenshots for documentation for windows users.
JohnTHaller 13y ago
Because most of the world's work is still done on Windows.
tigerweeds 13y ago
just out of curiosity: what are you using?
induscreep 13y ago

jontro 13y ago

The security holes are not critical but of course you should upgrade anyways. 3 of the holes have the following notice: We are currently unaware of any way in which this can lead to remote code execution. 4th hole is that putty does not cleanup sensitive memory when it could.

gcb0 13y ago
3 better-safe-than-sorry-in-improbably-scenario ones and one that requires an attacker to have physical access to your machine (or just to your memory and a good freezer, if you remember that hack hack :) Seems like the best time to upgrade is in a few weeks after the crypto community had some time to analyse the changes. Maybe upgrading in a rush is as bad nowadays than not upgrading, with all the ... terrorism?... going on.

randallsquared 13y ago

Since starting to use Windows 8, I found that the grouping behavior of the taskbar combined with a dozen open PuTTY windows drove me insane. There's a multiple-tabbed PuTTY shell, but it was hard to get used to as well. I finally switched to the Chrome SSH client, which has been much better (though it doesn't have nearly the features of PuTTY, of course).

fsckin 13y ago
If you've got a dozen open PuTTY windows, you should really look at SecureCRT. Tabbed sessions, tiling, configurable keyboard/mouse shortcuts, password encryption/automatic session login and best of all, scripting support for Perl/Python. It's $99, but I've easily saved 1000x that amount by being able to quickly script shell interactions that don't easily lend themselves to the regular scripting tools like 'expect'. I think the best example was where a distributed cache cluster was dirtied during a deployment. Dumping the entire 100TB+ of good data was not an option, it would have taken days to warm back up. The cache admin tool had a menu system and wouldn't buffer input, so I couldn't just dump a buffer of commands into it and wait for it to finish. I was able to lookup recently accessed DB rows in SSH tab #1, compare them to the cache in tab #2, and invalidate in another in tab #3. Problem solved in <20 minutes. We eventually built an app to invalidate dirty cached results, but that took about a week to do it the right way.
- gcb0 13y ago
  yeah, because managing windows is not the problem a window manager would be responsible for... what then? you have a dozen word documents? and a dozen text files? and a dozen images? ... do you keep changing your tools everytime you pass a window number threshold? just get rid of windows 8. as troll as this comment may sound...
  - taspeotis 13y ago
    just get rid of windows 8 I'm not aware of the grouping functionality changing between 7 to 8, at least to the extent that 8 doesn't group more aggressively than 7. In both operating systems you can customise whether applications are grouped or not. And although it's not necessarily PuTTY's job to change because of a new feature in the OS (taskbar grouping), I'd note that there is an API for controlling it [1]. [1] http://blogs.msdn.com/b/oldnewthing/archive/2012/08/20/10341464.aspx http://blogs.msdn.com/b/oldnewthing/archive/2012/08/20/10341...

megaman821 13y ago

As an alternative to PuTTY, MinGW with the OpenSSH package has been great.

voltagex_ 13y ago

I wonder if the diff will apply cleanly to Futty/PuTTYTray - they're still based on a 2012 build of 0.62. Edit: Blergh, SVN.

ereckers 13y ago

I was using Putty Connection Manager (puttycm) to allow for tabbed browsing of multiple windows, and after upgrading Putty I now get issues. Loads nothing but a grey screen. I'm working my way through it, but just wanted to pop in to see if anyone else had an issue. Circling back. Here's the solution: => open Putty Connection Manager => select Tools > Options => select Plugins > Putty => select "Enable additional timing for PuTTY capture (ms): set to 300ms => select Apply & OK

georgiecasey 13y ago

If anyone is looking for a Putty alternative, check out ZOC. It's great but it costs money.

ilikejam 13y ago

PuTTY's pretty much relegated to the emergency usb key these days. Runs on pretty much any Windows and without installing, but not really ideal for heavy use imho. Cygwin + urxvt + clusterssh is the choice of Windows-mandated champions.