Published: 09/07/2021 Updated: 25/04/2024

CVSS v2 Base Score: 5.8 | Impact Score: 4.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.1 | Impact Score: 5.2 | Exploitability Score: 2.8

VMScore: 518

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N

PuTTY up to and including 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication response. This makes it easier for an attacker-controlled SSH server to present a later spoofed authentication prompt (that the attacker can use to capture credential data, and use that data for purposes that are undesired by the client user).

Vulnerable Product	Search on Vulmon	Subscribe to Product
putty putty

Debian Bug report logs - #990901 putty: CVE-2021-36367 Package: src:putty; Maintainer for src:putty is Colin Watson <cjwatson@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 10 Jul 2021 21:27:04 UTC Severity: important Tags: security, upstream Found in versions putty/063-10+deb8u1, put ...

Fabian Baeumer, Marcus Brinkmann and Joerg Schwenk discovered that the SSH protocol is prone to a prefix truncation attack, known as the Terrapin attack This attack allows a MITM attacker to effect a limited break of the integrity of the early encrypted SSH transport protocol by sending extra messages prior to the commencement of encryption, and d ...

PuTTY through 075 proceeds with establishing an SSH session even if it has never sent a substantive authentication response This makes it easier for an attacker-controlled SSH server to present a later spoofed authentication prompt (that the attacker can use to capture credential data, and use that data for purposes that are undesired by the clie ...

SSH-MITM - ssh audits made simple ssh man-in-the-middle (ssh-mitm) server for security audits supporting publickey authentication, session hijacking and file manipulation Contributors Table of Contents Introduction Features Installation Quickstart Session hijacking Phishing FIDO Tokens Contributing Contact Introduction

SSH-MITM - ssh audits made simple ssh man-in-the-middle (ssh-mitm) server for security audits supporting publickey authentication, session hijacking and file manipulation Explore the docs » Table of Contents Introduction Features Installation Quickstart Session hijacking Publickey authentication Contributing Introduction

SSH-MITM - ssh audits made simple ssh man-in-the-middle (ssh-mitm) server for security audits supporting publickey authentication, session hijacking and file manipulation Contributors Table of Contents Introduction Features Installation Quickstart Session hijacking Phishing FIDO Tokens Contributing Contact Introduction

SSH-MITM - ssh audits made simple

SSH-MITM - ssh audits made simple ssh man-in-the-middle (ssh-mitm) server for security audits supporting publickey authentication, session hijacking and file manipulation         Contributors Table of Contents Introduction Features Installation Quickstart Session hi

SSH-MITM - ssh audits made simple ssh man-in-the-middle (ssh-mitm) server for security audits supporting publickey authentication, session hijacking and file manipulation Explore the docs » Table of Contents Introduction Features Installation Quickstart Session hijacking Phishing FIDO Tokens Contributing Introduction S

SSH-MITM Server SSH-MITM is a man in the middle (mitm) server for security audits supporting public key authentication, session hijacking and file manipulation Installation SSH-MITM The first step to using any software package is getting it properly installed To install SSH-MITM, simply run this simple command in your terminal of choice: $ pip install ssh-mitm

CWE-345 https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html https://git.tartarus.org/?p=simon/putty.git%3Ba=commit%3Bh=1dc5659aa62848f0aeb5de7bd3839fecc7debefa https://www.debian.org/security/2023/dsa-5588 https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=990901 https://www.debian.org/security/2023/dsa-5588 https://nvd.nist.gov https://github.com/ssh-mitm/ssh-mitm

CVE-2021-36367

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect