Bulgarian mirror 10 Gbps

PuTTY vulnerability vuln-windows-remote-title-dos

Home | FAQ | Feedback | Licence | Updates | Mirrors | Keys | Links | Team
Download: Stable · Snapshot | Docs | Changes | Wishlist

In the Windows version of PuTTY (and PuTTYtel), if the server sent a rapid series of terminal escape sequences that repeatedly changed the title of the terminal window, the Windows GUI could become unresponsive, because it couldn't keep up with all the title changes.

We think this is primarily a bug in Windows itself. (If it can't handle window title changes that quickly, it should apply a rate limit, or else a buggy local program can cause the same problem, by accident or on purpose.)

But PuTTY's feature of allowing server-controlled title changes had the effect of exporting that local bug over the network, and turning it into a remotely triggerable denial of service: it permits a server, or a server-side application with the ability to write to your terminal device, to DoS the client machine's Windows GUI.

In 0.75, the terminal code has been reworked so that title changes are buffered within PuTTY itself, and a rate limit is applied before they are passed on to the Windows API. So if the server changes the window title 10000 times in a second, only 50 of the title changes will actually get as far as the Windows API; the rest will just keep rewriting a buffer inside PuTTY's terminal emulation code.

For previous versions of PuTTY, an easy workaround is to disable the feature that allows the server to set the window title: on the Features panel, tick the box "Disable remote-controlled window title changing".

This vulnerability was discovered by Eviatar Gerzi of CyberArk Labs. It has been assigned CVE-2021-33500.