CVE-2004-1008

CVE-2004-1008 describes an integer signedness error in the ssh2_rdpkt function of PuTTY versions prior to 0.56, as well as related products like TortoiseCVS. This flaw allows remote attackers to execute arbitrary code by manipulating the stringlen parameter within a SSH2_MSG_DEBUG packet, leading to a buffer overflow. With a CVSS score of 10.0, this vulnerability is critical, requiring no authentication and having a low attack complexity, potentially resulting in complete compromise of confidentiality, integrity, and availability. Despite its high severity, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.