Executive Summary

This vulnerability in MTPutty version 1.0.1.21 allows local attackers to view SSH connection passwords in plaintext by accessing the Windows PowerShell process listing. Specifically, attackers can run a PowerShell command to retrieve the full command line of MTPutty processes, which includes the SSH passwords passed as command line arguments, exposing sensitive information. [2]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to disclosure of SSH passwords to any local user with sufficient privileges to query running processes. This means an attacker with local access to the affected system can obtain plaintext SSH credentials, potentially allowing unauthorized access to SSH servers and compromising system security. [2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the command line arguments of running putty.exe processes to see if SSH passwords are exposed in plaintext. A suggested command to detect this on a Windows system is: Get-WmiObject Win32_Process | select name, commandline | findstr putty.exe [2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting local user access to systems running MTPutty 1.0.1.21 to prevent unauthorized process inspection, avoiding storing passwords in command line parameters, and updating or replacing MTPutty with a version that does not expose passwords in process command lines. [2]

Useful 0 Not Useful 0