CVE-2017-6542

The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message and leveraging the ability to connect to the Unix-domain socket representing the forwarded agent connection, which trigger a buffer overflow.

• CWE-119

• http://lists.opensuse.org/opensuse-updates/2017-03/msg00055.htmlThird Party Advisory
• http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-fwd-overflow.htmlPatch, Vendor Advisory
• http://www.securityfocus.com/bid/97156Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1038067
• https://git.tartarus.org/?p=simon/putty.git%3Ba=commitdiff%3Bh=4ff22863d895cb7ebfced4cf923a012a614adaa8
• https://security.gentoo.org/glsa/201703-03Third Party Advisory, VDB Entry
• https://security.gentoo.org/glsa/201706-09
• https://www.exploit-db.com/exploits/42137/
• http://lists.opensuse.org/opensuse-updates/2017-03/msg00055.htmlThird Party Advisory
• http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-fwd-overflow.htmlPatch, Vendor Advisory
• http://www.securityfocus.com/bid/97156Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1038067
• https://git.tartarus.org/?p=simon/putty.git%3Ba=commitdiff%3Bh=4ff22863d895cb7ebfced4cf923a012a614adaa8
• https://security.gentoo.org/glsa/201703-03Third Party Advisory, VDB Entry
• https://security.gentoo.org/glsa/201706-09
• https://www.exploit-db.com/exploits/42137/

Published

Mar 27, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-6536Multiple Cross-Site Scripting (XSS) issues were discovered i…
• CVE-2017-6537A Cross-Site Scripting (XSS) issue was discovered in webpage…
• CVE-2017-6538A Cross-Site Scripting (XSS) issue was discovered in webpage…
• CVE-2017-6539Multiple Cross-Site Scripting (XSS) issues were discovered i…
• CVE-2017-6540Multiple Cross-Site Scripting (XSS) issues were discovered i…
• CVE-2017-6541Multiple Cross-Site Scripting (XSS) issues were discovered i…
• CVE-2017-6543Tenable Nessus before 6.10.2 (as used alone or in Tenable Ap…
• CVE-2017-6544Gargaj/wuhu through 2017-03-08 is vulnerable to a reflected …
• CVE-2017-6547Cross-site scripting (XSS) vulnerability in httpd on ASUS RT…
• CVE-2017-6548Buffer overflows in networkmap on ASUS RT-N56U, RT-N66U, RT-…
• CVE-2017-6549Session hijack vulnerability in httpd on ASUS RT-N56U, RT-N6…
• CVE-2017-6550Multiple SQL injection vulnerabilities in Kinsey Infor-Lawso…