PT-2009-5479 · Silc · Silc Toolkit+1
Nico Golde
·
Publicado
2009-09-10
·
Atualizado
2012-10-23
·
CVE-2009-3163
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions:
SILC Toolkit versions prior to 1.1.10
SILC Client versions prior to 1.1.9
Description:
The issue is related to multiple format string vulnerabilities in the SILC Toolkit and SILC Client. These vulnerabilities allow remote attackers to execute arbitrary code via format string specifiers in a channel name. The affected functions include silc client command topic, silc client command kick, silc client command leave, and silc client command users.
Recommendations:
For SILC Toolkit versions prior to 1.1.10, update to version 1.1.10 or later.
For SILC Client versions prior to 1.1.9, update to version 1.1.9 or later.
As a temporary workaround, consider restricting access to the channel name parameter to minimize the risk of exploitation.
Correção
Use of Externally-Controlled Format String
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Silc Client
Silc Toolkit