Researchers identified a vulnerable DSA implementation in PuTTY SSH libraries (versions 0.68–0.80), CVE-2024-31497, which could allow private-key reconstruction by observing signatures. Stairwell adds a broader list of potentially vulnerable software, known hashes, and a YARA rule to detect affected binaries across environments. #PuTTY #CVE-2024-31497 #WinSCP #TortoiseGit #FileZilla
Keypoints
- Researchers identified CVE-2024-31497 in PuTTY SSH libraries versions 0.68–0.80, enabling potential private-key reconstruction by observing signatures.
- The vulnerability could affect software beyond PuTTY itself, with PuTTY 0.81+ fixing the issue but third-party software needing updates.
- Stairwell expands the potentially vulnerable software list beyond the NIST advisory (which includes WinSCP, TortoiseGit, and FileZilla) using their YARA rule.
- Stairwell provides known vulnerable hashes and a YARA rule to help detect vulnerable binaries across environments.
- The YARA rule relies on the string “ECDSA deterministic k generator” found in pre-0.81 versions, indicating vulnerable code in third-party software using PuTTY libraries.
- The patch moves to an RFC6979-based ECDSA implementation, as noted in a referenced commit.
- Although not remotely exploitable, the vulnerability poses high risk due to potential private-key compromise in enterprise key-based authentication and supply-chain contexts.
MITRE Techniques
- [T1552.004] Private Keys – Attacker could reconstruct the private key used in key-based authentication by observing cryptographic signatures. ‘The CVE-2024-31497 PuTTY vulnerability could allow an attacker to reconstruct the private key used in key-based authentication by observing cryptographic signatures.’
Indicators of Compromise
- [Hash] Known vulnerable hashes – 06861c22056919216f925892334ba29b4a2848a7a09c3611540b16e993fd6cc3, eb1b278b91a8f183f9749948abd9556ec21b03ca852c53e423d824d5d7cc3de4, and other hashes
- [File] Vulnerable PuTTY-related binaries – w64/putty.exe, w64/psftp.exe, and other binaries using PuTTY libraries