Software update: PuTTY 0.56 beta

PuTTY has been updated to version 0.56 beta. This program is one of the most popular telnet and SSH clients. The program is available for both the Windows– if Unix-platform. The developers have patched a serious security issue in this release that could allow a server to run arbitrary code on a client. Everyone is therefore strongly advised to upgrade to this version. The full changelog looks like this:

New in beta 0.56:

• Security fix: a vulnerability discovered by iDEFENSE, potentially allowing arbitrary code execution on the client by a malicious SSH2 server before host key verification, has been fixed.
• Ability to restart a session within an inactive window, via a new menu option.
• Minimal support for not running a shell or command at all in SSH protocol 2 (equivalent to OpenSSH’s “-N” option). PuTTY/Plink still provide a normal window for interaction, and have to be explicitly killed.
• Transparent support for CHAP cryptographic authentication in the SOCKS 5 proxy protocol. (Not in PuTTYtel.)
• More diagnostics in the Event Log, particularly of SSH port forwarding.
• Ability to request setting of environment variables in SSH (protocol 2 only). (However, we don’t know of any servers that support this.)
• Ability to send POSIX signals in SSH (protocol 2 only) via the “Special Commands” menu. (Again, we don’t know of any servers supporting this.)
• Bug fix: The PuTTY tools now more consistently support usernames containing “@” signs.
• Support for the Polish character set “Mazovia”.
• When logging is enabled, the log file is flushed more frequently, so that its contents can be viewed before it is closed.
• More flexibility in SSH packet logging: known passwords and session data can be omitted from the log file. Passwords are omitted by default. (This option isn’t perfect for removing sensitive details; you should still review log files before letting them out of your sight.)
• Unix specific changes:
  • Ability to set environment variables in pterm.
  • PuTTY and pterm attempt to use a UTF-8 line character set by default if this is indicated by the locale; however, this can be overridden.