CVE-2021-33500
📋 TL;DR
This vulnerability allows remote SSH servers to cause a denial of service by rapidly changing the PuTTY window title, causing the Windows GUI to hang. It affects PuTTY users on Windows versions before 0.75. Similar attacks may affect other OS-level GUIs on Linux or other platforms.
💻 Affected Systems
- PuTTY
📦 What is this software?
Putty by Putty
⚠️ Risk & Real-World Impact
Worst Case
Complete GUI hang requiring manual termination of PuTTY process, potentially disrupting SSH sessions and causing data loss.
Likely Case
Temporary GUI unresponsiveness requiring user intervention to restore functionality.
If Mitigated
Minimal impact with proper patching or workarounds in place.
🎯 Exploit Status
Public exploit scripts available in ssh-mitm-plugins repository; attack requires malicious SSH server.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.75 and later
Vendor Advisory: https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
Restart Required: No
Instructions:
1. Download PuTTY 0.75 or later from official website. 2. Install or replace existing PuTTY installation. 3. No restart required.
🔧 Temporary Workarounds
Disable window title updates
allConfigure PuTTY to ignore window title change requests from server
In PuTTY configuration: Connection > SSH > Remote terminal > Disable remote-controlled window title
Use alternative SSH clients
allSwitch to non-vulnerable SSH clients like OpenSSH, SecureCRT, or MobaXterm
🧯 If You Can't Patch
- Only connect to trusted SSH servers
- Monitor for unusual SSH server behavior and disconnect if GUI becomes unresponsive
🔍 How to Verify
Check if Vulnerable:
Check PuTTY version in Help > About menu; versions before 0.75 are vulnerable.Check Version:
putty.exe -V (may not work on all versions)Verify Fix Applied:
Verify PuTTY version is 0.75 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Rapid window title change events in Windows event logs
- Multiple SetWindowTextA/W API calls
Network Indicators:
- SSH connections with rapid SSH_MSG_CHANNEL_REQUEST packets for window title changes
SIEM Query:
Process:putty.exe AND (EventID:4656 OR EventID:4688) AND CommandLine:*ssh*🔗 References
- https://docs.ssh-mitm.at/puttydos.html
- https://github.com/ssh-mitm/ssh-mitm-plugins/blob/main/ssh_mitm_plugins/ssh/putty_dos.py
- https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
- https://docs.ssh-mitm.at/puttydos.html
- https://github.com/ssh-mitm/ssh-mitm-plugins/blob/main/ssh_mitm_plugins/ssh/putty_dos.py
- https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
