CVE-2017-6542 PuTTY ssh_agent_channel_data Function Integer Overflow Vulnerability

PuTTY is a client program for the SSH, Telnet and Rlogin network protocols. It is integrated in multiple applications on multiple operating systems for providing SSH, Telnet and Rlogin protocol support.

A heap-corrupting integer overflow vulnerability exists in the ssh_agent_channel_data function, which processes messages sent by remote SSH clients to a forwarded agent connection.

Affected Version:
PuTTY before 0.68

Successful exploitation could allow remote attackers to have unspecified impact via a large length value in an agent protocol message.

Customers are advised to upgrade to PuTTY 0.68 or later version in order to remediate this vulnerability.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

PuTTY before 0.68