PuTTY vulnerability vuln-window-title

Home | FAQ | Feedback | Licence | Updates | Mirrors | Keys | Links | Team
Download: Stable · Snapshot | Docs | Changes | Wishlist

summary: Window title reports offer opportunities for mischief
class: vulnerability: This is a security vulnerability.
difficulty: fun: Just needs tuits, and not many of them.
priority: high: This should be fixed in the next release.
absent-in: 0.52 2001-11-24
present-in: 0.53 0.53b
fixed-in: 2003-04-13 4b6ffd99f1b22dde0e95fe5a6b63ed7f16584ee5 (0.54)

It's been suggested that window-title reports might be a bad idea, since they allow anyone who can generate arbitrary output to a terminal to cause almost-arbitrary input from it. The various other terminal reports supported by PuTTY are less of a problem because their formats are rather more constrained.

PuTTY should probably make window-title reporting support optional and have it default to off.

This vulnerability corresponds to CVE-2003-0069 .

SGT, 2003-04-12: Just fixed this.


If you want to comment on this web site, see the Feedback page.
Audit trail for this vulnerability.
(last revision of this bug record was at 2016-12-27 11:40:22 +0000)