中危 filezilla 安全漏洞 (CVE-2024-31497)

CVE编号

CVE-2024-31497

利用情况

暂无

补丁情况

官方补丁

披露时间

2024-04-04
漏洞描述
In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a users NIST P-521 secret key via a quick attack in approximately 60 signatures. This is especially important in a scenario where an adversary is able to read messages signed by PuTTY or Pageant. The required set of signed messages may be publicly readable because they are stored in a public Git service that supports use of SSH for commit signing, and the signatures were made by Pageant through an agent-forwarding mechanism. In other words, an adversary may already have enough signature information to compromise a victims private key, even if there is no further use of vulnerable PuTTY versions. After a key compromise, an adversary may be able to conduct supply-chain attacks on software maintained in Git. A second, independent scenario is that the adversary is an operator of an SSH server to which the victim authenticates (for remote login or file copy), even though this server is not fully trusted by the victim, and the victim uses the same private key for SSH connections to other services operated by other entities. Here, the rogue server operator (who would otherwise have no way to determine the victims private key) can derive the victims private key, and then use it for unauthorized access to those other services. If the other services include Git services, then again it may be possible to conduct supply-chain attacks on software maintained in Git. This also affects, for example, FileZilla before 3.67.0, WinSCP before 6.3.3, TortoiseGit before 2.15.0.1, and TortoiseSVN through 1.14.6.


解决建议
建议您更新当前系统或软件至最新版,完成漏洞的修复。
参考链接
http://www.openwall.com/lists/oss-security/2024/04/15/6
https://bugzilla.redhat.com/show_bug.cgi?id=2275183
https://bugzilla.suse.com/show_bug.cgi?id=1222864
https://docs.ccv.brown.edu/oscar/connecting-to-oscar/ssh/ssh-agent-forwarding...
https://filezilla-project.org/versions.php
https://git.tartarus.org/?h=c193fe9848f50a88a4089aac647fecc31ae96d27&p=simon/...
https://github.com/advisories/GHSA-6p4c-r453-8743
https://github.com/daedalus/BreakingECDSAwithLLL
https://lists.debian.org/debian-lts-announce/2024/06/msg00014.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://news.ycombinator.com/item?id=40044665
https://security-tracker.debian.org/tracker/CVE-2024-31497
https://securityonline.info/cve-2024-31497-critical-putty-vulnerability-expos...
https://tartarus.org/~simon/putty-snapshots/htmldoc/Chapter9.html#pageant-forward
https://tortoisegit.org
https://twitter.com/CCBalert/status/1780229237569470549
https://twitter.com/lambdafu/status/1779969509522133272
https://winscp.net/eng/news.php
https://www.bleepingcomputer.com/news/security/putty-ssh-client-flaw-allows-r...
https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-p521-bias.html
https://www.openwall.com/lists/oss-security/2024/04/15/6
https://www.reddit.com/r/sysadmin/comments/1c4wmoj/putty_vulnerability_affect...
受影响软件情况
# 类型 厂商 产品 版本 影响面
1
运行在以下环境
应用 filezilla-project filezilla_client * Up to
(excluding)
3.67.0
运行在以下环境
应用 putty putty * From
(including)
0.68
Up to
(excluding)
0.81
运行在以下环境
应用 tigris tortoisesvn * Up to
(excluding)
1.14.6
运行在以下环境
应用 tortoisegit tortoisegit * Up to
(excluding)
2.15.0.1
运行在以下环境
应用 winscp winscp * Up to
(excluding)
6.3.3
运行在以下环境
系统 alpine_3.16 putty * Up to
(excluding)
0.81-r0
运行在以下环境
系统 alpine_3.17 putty * Up to
(excluding)
0.81-r0
运行在以下环境
系统 alpine_3.18 putty * Up to
(excluding)
0.81-r0
运行在以下环境
系统 alpine_3.19 putty * Up to
(excluding)
0.81-r0
运行在以下环境
系统 fedoraproject fedora 38 -
运行在以下环境
系统 fedoraproject fedora 39 -
运行在以下环境
系统 fedoraproject fedora 40 -
运行在以下环境
系统 fedora_38 putty * Up to
(excluding)
0.81-1.fc38
运行在以下环境
系统 fedora_39 putty * Up to
(excluding)
0.81-1.fc39
运行在以下环境
系统 fedora_40 putty * Up to
(excluding)
0.81-1.fc40
运行在以下环境
系统 fedora_EPEL_8 putty * Up to
(excluding)
0.81-1.el8
运行在以下环境
系统 fedora_EPEL_9 putty * Up to
(excluding)
0.81-1.el9
阿里云评分
5.4
  • 攻击路径
    本地
  • 攻击复杂度
    困难
  • 权限要求
    管控权限
  • 影响范围
    有限影响
  • EXP成熟度
    未验证
  • 补丁情况
    官方补丁
  • 数据保密性
    无影响
  • 数据完整性
    无影响
  • 服务器危害
    无影响
  • 全网数量
    N/A
CWE-ID 漏洞类型
CWE-338 使用具有密码学弱点缺陷的PRNG
阿里云安全产品覆盖情况