PT-2008-3111 · Silc · Silc Toolkit+3

Publicado 2008-03-31 · Atualizado 2018-10-11 · CVE-2008-1552

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SILC Toolkit versions prior to 1.1.7 SILC Client versions prior to 1.1.4 SILC Server versions prior to 1.1.2

Description The silc pkcs1 decode function in the silccrypt library allows remote attackers to execute arbitrary code via a crafted PKCS#1 message. This is due to an integer underflow, signedness error, and a buffer overflow, which can be triggered by a specially crafted message.

Recommendations For SILC Toolkit versions prior to 1.1.7, update to version 1.1.7 or later. For SILC Client versions prior to 1.1.4, update to version 1.1.4 or later. For SILC Server versions prior to 1.1.2, update to version 1.1.2 or later.

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2008-1552

Produtos afetados

Silc Client

Silc Server

Silc Toolkit

Silccrypt Library

Referências · 20

• https://nvd.nist.gov/vuln/detail/CVE-2008-1552 · Nota de Segurança
• http://vupen.com/english/advisories/2008/0974/references · Nota
• http://secunia.com/advisories/29465 · Nota
• http://coresecurity.com/?action=item&id=2206 · Nota
• http://secunia.com/advisories/29622 · Nota
• http://securitytracker.com/id?1019690 · Nota
• http://silcnet.org/general/news/?item=toolkit_20080320_1 · Correção
• http://securityreason.com/securityalert/3795 · Nota
• http://silcnet.org/general/news/?item=client_20080320_1 · Correção
• http://mandriva.com/security/advisories?name=MDVSA-2008:158 · Aviso do Fabricante
• http://silcnet.org/general/news/?item=server_20080320_1 · Correção
• http://secunia.com/advisories/29946 · Nota
• http://secunia.com/advisories/29463 · Aviso do Fabricante
• http://securityfocus.com/bid/28373 · Correção
• http://securityfocus.com/archive/1/490069/100/0/threaded · Nota