Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PuTTY 0.68 has been released

chiark.greenend.org.uk

Post reply on HN
Print view View original

51–60 of 152 posts

Re: PuTTY 0.68 has been released

#51

Post by zer0t3ch »

based2 wrote: post #2

Release Notes: Security fix: an integer overflow bug in the agent forwarding code. See vuln-agent-fwd-overflow. Security fix: the Windows PuTTY binaries should no longer be vulnerable to hijacking by specially named DLLs in the same directory (on versions of Windows where they previously were). See vuln-indirect-dll-hijack. Windows PuTTY no longer sets a restrictive process ACL by default, because this turned out to…

> Support for importing and exporting OpenSSH's new private key format

What new private key format is that?

Re: PuTTY 0.68 has been released

#52

Post by caf »

based2 wrote: post #2

Release Notes: Security fix: an integer overflow bug in the agent forwarding code. See vuln-agent-fwd-overflow. Security fix: the Windows PuTTY binaries should no longer be vulnerable to hijacking by specially named DLLs in the same directory (on versions of Windows where they previously were). See vuln-indirect-dll-hijack. Windows PuTTY no longer sets a restrictive process ACL by default, because this turned out to…

Isn't this "DLL hijacking" thing a bit overblown? The directory an application runs from on Windows has always been considered part of the security perimeter of the application.

If you can drop a malicious DLL where putty.exe lives, can't you just drop a malicious putty.exe?

Re: PuTTY 0.68 has been released

#53

Post by h1d »

niftich wrote: post #36
anderskaseorg wrote: post #31

Earlier quoted context omitted.

And obviously a network attacker would never think to modify the insecurely served downloads page to point to a different download URL.

This is a possibility. But downloads have been served out of "the.earth.li/~sgtatham/putty/" for years. Yes, it's owned by someone else and exploding turtles all the way down [1], but now that "the.earth.li/~sgtatham/putty/" is HTTPS, the checksums are properly authentic as attested by the same operator as the one who has supplied PuTTY downloads for years. I've mirrored the most important checksums here, another HTT…

It also accounts for who administers that domain. Usually uncommon domain doesn't sound more secure than been provided from larger known sources.

Re: PuTTY 0.68 has been released

#54

Post by __jal »

caf wrote: post #52
based2 wrote: post #2

Release Notes: Security fix: an integer overflow bug in the agent forwarding code. See vuln-agent-fwd-overflow. Security fix: the Windows PuTTY binaries should no longer be vulnerable to hijacking by specially named DLLs in the same directory (on versions of Windows where they previously were). See vuln-indirect-dll-hijack. Windows PuTTY no longer sets a restrictive process ACL by default, because this turned out to…

Isn't this "DLL hijacking" thing a bit overblown? The directory an application runs from on Windows has always been considered part of the security perimeter of the application. If you can drop a malicious DLL where putty.exe lives, can't you just drop a malicious putty.exe?

Not a windows person, so I can't speak to how the directory is treated, but I've watched enough people run applications from the Downloads directory to wonder about it.

Re: PuTTY 0.68 has been released

#55

Post by SebiH »

kylek wrote: post #48
SebiH wrote: post #27

Earlier quoted context omitted.

Are you using an insider build or a different shell than Windows' cmd? I find myself using Putty to connect to a Linux subsystem ssh server just to get a decent terminal emulator with full colour support!

You may be interested in ConEmu: https://conemu.github.io/ https://conemu.github.io/en/BashOnWindows.html

I did try conemu when bash for windows was first released, but ran into some problems. Will definitely try again, thanks! Though the wsltty linked below looks promising as well

Re: PuTTY 0.68 has been released

#56

Post by beachstartup »

__jal wrote: post #54
caf wrote: post #52

Earlier quoted context omitted.

Isn't this "DLL hijacking" thing a bit overblown? The directory an application runs from on Windows has always been considered part of the security perimeter of the application. If you can drop a malicious DLL where putty.exe lives, can't you just drop a malicious putty.exe?

Not a windows person, so I can't speak to how the directory is treated, but I've watched enough people run applications from the Downloads directory to wonder about it.

with putty i would be surprised if most didn't run it straight from the desktop. i would be a dirty liar if i said i haven't, countless times.

Re: PuTTY 0.68 has been released

#57

Post by bubblethink »

Raticide wrote: post #47
ReverseCold wrote: post #42

Earlier quoted context omitted.

Another option: SSH inside WSL in windows 10.

The default terminal was a bit limited for me, but I hear they're making big improvements to it in later builds.

I tried that briefly too, and I couldn't launch screen. It seems to trigger some old bug in screen. How far is the WSL terminal from the usual fanfare (screen, tmux, proper colors in the terminal and text editors, and other edge cases for scrollback etc.) ?

Re: PuTTY 0.68 has been released

#58

Post by gcp »

kiwijamo wrote: post #17
gcp wrote: post #3

Putty used to be the go-to tool for Windows SSH, but nowadays I'm using Bitvise SSH client. It's worth a try.

What advantages does it offer over PuTTY?

Easy to open multiple terminals from the same connection, built-in SFTP. Probably better font rendering or something.

Re: PuTTY 0.68 has been released

#59

Post by wtbob »

When I started my career nearly 20 years ago, back before one could convince a Fortune-100 company to let its peons use Linux on our desktops and Apple hadn't yet had its renascence, PuTTY was a veritable godsend: it did what was needed, and did it remarkably well.

It's been years since I was allowed to add a Linux box, and years since I switched to Linux full-time, and now I honestly think that I'd reject a job offer which required Windows (and maybe even one which required macOS) — but for all those years of Just Working™, thanks PuTTY!

Re: PuTTY 0.68 has been released

#60

Post by jwilk »

zer0t3ch wrote: post #51
based2 wrote: post #2

Release Notes: Security fix: an integer overflow bug in the agent forwarding code. See vuln-agent-fwd-overflow. Security fix: the Windows PuTTY binaries should no longer be vulnerable to hijacking by specially named DLLs in the same directory (on versions of Windows where they previously were). See vuln-indirect-dll-hijack. Windows PuTTY no longer sets a restrictive process ACL by default, because this turned out to…

> Support for importing and exporting OpenSSH's new private key format What new private key format is that?

http://www.tedunangst.com/flak/post/new-openssh-key-format-a...
Post reply on HN