CVE-2003-0069
published 2003-03-18CVE-2003-0069: The PuTTY terminal emulator 0.53 allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command…
PriorityP428high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
2.20%
80.5th percentile
The PuTTY terminal emulator 0.53 allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | putty | < putty 0.54-1 (bookworm) | putty 0.54-1 (bookworm) |
| github.com | mutagen-io_mutagen | >= 0 < 0.16.6 | 0.16.6 |
| github.com | mutagen-io_mutagen | >= 0.17.0 < 0.17.1 | 0.17.1 |
| github.com | mutagen-io_mutagen-compose | >= 0 < 0.17.1 | 0.17.1 |
| mutagen-io | mutagen | — | — |
| mutagen-io | mutagen | — | — |
| mutagen-io | mutagen | — | — |
| mutagen | mutagen | < 0.16.6 | 0.16.6 |
| mutagen | mutagen | — | — |
| mutagen | mutagen_compose | < 0.17.1 | 0.17.1 |
| putty | putty | — | — |
| putty | putty | >= 0 < 0.54-1 | 0.54-1 |
| putty | putty | >= 0 < 0.54-1 | 0.54-1 |
| putty | putty | >= 0 < 0.54-1 | 0.54-1 |
| putty | putty | >= 0 < 0.54-1 | 0.54-1 |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa7.5HIGH
osv7.5HIGH
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints
ghsa·2023-05-05·CVSS 7.5
CVE-2023-30844 [HIGH] CWE-116 Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints
Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints
### Impact
Mutagen command line operations, as well as the log output from `mutagen daemon run`, are susceptible to control characters that could be provided by remote endpoints. This can cause terminal corruption, either intentional or unintentional, if these characters are present in error messages, file paths/names, and/or log output. This could be used as an attack vector if synchronizing with an untrusted remote endpoint, synchronizing files not under control of the user, or forwarding to/from an untrusted remote endpoint. On very old systems with terminals susceptible to issues such as [CVE-2003-0069](https://nvd.nist.gov/vuln/detail/CVE-2003-0069), the issue could theore
OSV
Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints
osv·2023-05-05·CVSS 7.5
CVE-2023-30844 [HIGH] Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints
Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints
### Impact
Mutagen command line operations, as well as the log output from `mutagen daemon run`, are susceptible to control characters that could be provided by remote endpoints. This can cause terminal corruption, either intentional or unintentional, if these characters are present in error messages, file paths/names, and/or log output. This could be used as an attack vector if synchronizing with an untrusted remote endpoint, synchronizing files not under control of the user, or forwarding to/from an untrusted remote endpoint. On very old systems with terminals susceptible to issues such as [CVE-2003-0069](https://nvd.nist.gov/vuln/detail/CVE-2003-0069), the issue could theore
GHSA
GHSA-cqhr-cfp6-qx66: The PuTTY terminal emulator 0
ghsa_unreviewed·2022-04-29
CVE-2003-0069 [HIGH] GHSA-cqhr-cfp6-qx66: The PuTTY terminal emulator 0
The PuTTY terminal emulator 0.53 allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.
OSV
CVE-2003-0069: The PuTTY terminal emulator 0
osv·2003-03-18·CVSS 7.5
CVE-2003-0069 [HIGH] CVE-2003-0069: The PuTTY terminal emulator 0
The PuTTY terminal emulator 0.53 allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.
Debian
CVE-2003-0069: putty - The PuTTY terminal emulator 0.53 allows attackers to modify the window title via...
vendor_debian·2003·CVSS 7.5
CVE-2003-0069 [HIGH] CVE-2003-0069: putty - The PuTTY terminal emulator 0.53 allows attackers to modify the window title via...
The PuTTY terminal emulator 0.53 allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.
Scope: local
bookworm: resolved (fixed in 0.54-1)
bullseye: resolved (fixed in 0.54-1)
forky: resolved (fixed in 0.54-1)
sid: resolved (fixed in 0.54-1)
trixie: resolved (fixed in 0.54-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.htmlhttp://marc.info/?l=bugtraq&m=104612710031920&w=2http://www.iss.net/security_center/static/11414.phphttp://www.osvdb.org/8347http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.htmlhttp://marc.info/?l=bugtraq&m=104612710031920&w=2http://www.iss.net/security_center/static/11414.phphttp://www.osvdb.org/8347
2003-03-18
Published