PT-2009-6692 · Silc+1 · Libsilc-1.1-2+4

Published 1970-01-01 · Updated 2017-08-17 · CVE-2008-7159

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SILC Toolkit versions prior to 1.1.8 libsilc-1.1-2 (affected versions not specified) libsilc-1.1-2-dev (affected versions not specified) libsilc-1.1-2-dbg (affected versions not specified)

Description The issue concerns multiple vulnerabilities in the SILC Toolkit and related packages in the Debian GNU/Linux operating system. These vulnerabilities can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Specifically, the silc asn1 encoder function in lib/silcasn1/silcasn1 encode.c is vulnerable to remote attacks that could overwrite a stack location and possibly execute arbitrary code via a crafted OID value, related to the incorrect use of a %lu format string.

Recommendations For SILC Toolkit versions prior to 1.1.8: Update to version 1.1.8 or later. For libsilc-1.1-2, libsilc-1.1-2-dev, and libsilc-1.1-2-dbg: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

BDU:2015-02900

BDU:2015-02901

BDU:2015-02902

BDU:2015-02903

CVE-2008-7159

DSA-1879-1

Affected Products

Debian

Silc Toolkit

Libsilc-1.1-2

Libsilc-1.1-2-Dbg

Libsilc-1.1-2-Dev

References · 20

• http://secunia.com/advisories/36625 · Vendor Advisory
• http://securityfocus.com/bid/36192 · Patch
• https://bdu.fstec.ru/vul/2015-02900 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3051 · Security Note
• https://bdu.fstec.ru/vul/2015-02903 · Security Note
• http://silcnet.org/general/news/news_toolkit.php · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7159 · Security Note
• https://bdu.fstec.ru/vul/2015-02901 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2009:234 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02902 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-7159 · Security Note
• http://openwall.com/lists/oss-security/2009/08/31/5 · Patch
• http://secunia.com/advisories/36614 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7160 · Security Note