KiTTY vulnerable to stack-based buffer overflow via hostname
CVE-2024-25003

7.8HIGH

Key Information:

Vendor

KiTTY

Status
Kitty
Vendor
CVE Published:
9 February 2024

What is CVE-2024-25003?

KiTTY, a popular fork of PuTTY, is susceptible to a stack-based buffer overflow vulnerability in versions 0.76.1.13 and earlier. The weakness arises from inadequate bounds checking and input sanitization, specifically when processing the hostname. An attacker exploiting this vulnerability can manipulate the input to overwrite adjacent memory, potentially leading to arbitrary code execution, which could compromise system integrity. Users of KiTTY are advised to review their versions and apply necessary security measures.

References

http://packetstormsecurity.com/files/177032/KiTTY-0.76.1....
http://packetstormsecurity.com/files/177031/KiTTY-0.76.1....
https://blog.defcesco.io/CVE-2024-25003-CVE-2024-25004

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.