CVE-2021-36367 – This vulnerability in PuTTY allows an attacker-... (How to Fix)

Q: What is the severity of CVE-2021-36367?

CVE-2021-36367 has a CVSS score of 8.1 (HIGH). This vulnerability in PuTTY allows an attacker-controlled SSH server to present a spoofed authentication prompt after establishing a connection, even without proper authentication. This could capture user credentials which could then be used for unauthorized access. All PuTTY users connecting to untrusted SSH servers are affected.

📋 TL;DR

This vulnerability in PuTTY allows an attacker-controlled SSH server to present a spoofed authentication prompt after establishing a connection, even without proper authentication. This could capture user credentials which could then be used for unauthorized access. All PuTTY users connecting to untrusted SSH servers are affected.

💻 Affected Systems

Products:

PuTTY

Versions: All versions through 0.75

Operating Systems: Windows, Linux, macOS

Default Config Vulnerable: ⚠️ Yes

Notes: All PuTTY configurations are vulnerable when connecting to SSH servers.

📦 What is this software?

Putty by Putty

View all CVEs affecting Putty →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers capture valid SSH credentials and use them to gain unauthorized access to systems, potentially leading to data theft, system compromise, or lateral movement.

🟠

Likely Case

Users connecting to malicious or compromised SSH servers have their credentials stolen, leading to unauthorized access to the systems those credentials protect.

🟢

If Mitigated

With proper network controls and user awareness, impact is limited to credential exposure without successful follow-on attacks.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires attacker to control the SSH server or intercept connections to legitimate servers.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 0.76 and later

Vendor Advisory: https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html

Restart Required: No

Instructions:

1. Download PuTTY 0.76 or later from official website. 2. Uninstall old version. 3. Install new version. 4. Verify version with 'putty -V' command.

🔧 Temporary Workarounds

Use alternative SSH clients

all

Temporarily switch to other SSH clients like OpenSSH, SecureCRT, or MobaXterm until PuTTY is patched.

Restrict SSH connections

all

Only connect to trusted SSH servers with verified certificates and known host keys.

🧯 If You Can't Patch

Implement network segmentation to restrict SSH traffic to trusted servers only
Use multi-factor authentication for SSH access to reduce impact of credential theft

🔍 How to Verify

Check if Vulnerable:

Check PuTTY version: if version is 0.75 or earlier, it is vulnerable.

Check Version:

putty -V

Verify Fix Applied:

Verify PuTTY version is 0.76 or later using 'putty -V' command.

📡 Detection & Monitoring

Log Indicators:

Unusual authentication prompts from SSH servers
Multiple failed authentication attempts from single source

Network Indicators:

SSH connections to unknown or suspicious servers
Unusual SSH traffic patterns

SIEM Query:

source="putty*" AND (event_description="authentication prompt" OR event_description="credential request")

📊 Metadata

CVE ID: CVE-2021-36367

CVSS v3 Score: 8.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE: CWE-345

Published: July 9, 2021

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-36367, you might also want to check these: