CVE-2019-17067
📋 TL;DR
This vulnerability in PuTTY on Windows allows attackers to hijack incoming SSH port-forwarding connections by listening on the same port. Attackers can intercept or steal sensitive data transmitted through forwarded connections. Only Windows users running PuTTY versions before 0.73 with port forwarding enabled are affected.
💻 Affected Systems
- PuTTY
📦 What is this software?
Putty by Putty
⚠️ Risk & Real-World Impact
Worst Case
Attackers intercept SSH port-forwarded connections containing sensitive data like credentials, database queries, or internal network traffic, leading to data theft, lateral movement, or complete system compromise.
Likely Case
Attackers on the same Windows machine steal forwarded connections to internal services, potentially capturing authentication tokens, session data, or sensitive information from forwarded ports.
If Mitigated
With proper network segmentation and monitoring, impact is limited to potential data leakage from intercepted forwarded connections on compromised endpoints.
🎯 Exploit Status
Exploitation requires local access to the Windows machine running vulnerable PuTTY. Attackers can use simple socket binding techniques to hijack the same port.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.73 and later
Vendor Advisory: https://lists.tartarus.org/pipermail/putty-announce/2019/000029.html
Restart Required: No
Instructions:
1. Download PuTTY 0.73 or later from official website. 2. Uninstall old version. 3. Install new version. 4. Verify version with 'putty -V' command.
🔧 Temporary Workarounds
Disable Port Forwarding
windowsDisable all port forwarding in PuTTY sessions to prevent exploitation.
In PuTTY Configuration: Connection > SSH > Tunnels > Remove all forwarded ports
Use Alternative SSH Client
windowsSwitch to a non-vulnerable SSH client like OpenSSH for Windows or WSL.
🧯 If You Can't Patch
- Restrict local user permissions to prevent unauthorized users from running applications on Windows machines.
- Implement network monitoring for unusual local port binding activity on Windows endpoints.
🔍 How to Verify
Check if Vulnerable:
Check PuTTY version: Run 'putty -V' or check About dialog. If version is below 0.73 and running on Windows, system is vulnerable.Check Version:
putty -VVerify Fix Applied:
Confirm PuTTY version is 0.73 or higher using 'putty -V' command. Test port forwarding functionality to ensure it works without allowing port hijacking.📡 Detection & Monitoring
Log Indicators:
- Multiple processes binding to same local port in Windows event logs
- Failed SSH port forwarding connections in PuTTY logs
Network Indicators:
- Unexpected local port listening on Windows machines with PuTTY running
- SSH connection attempts to forwarded ports from unexpected sources
SIEM Query:
Process Creation where Image contains 'putty.exe' AND CommandLine contains '-L' OR '-R' AND Version < 0.73