PT-2009-6694 · Silc · Silc Toolkit+1
William Cummings
·
Published
1970-01-01
·
Updated
2012-10-23
·
CVE-2009-3051
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
SILC Toolkit versions prior to 1.1.10
SILC Client versions prior to 1.1.8
Description
The issue concerns multiple vulnerabilities in the SILC Toolkit and SILC Client, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. The vulnerabilities are related to format string specifiers in a nickname field and are associated with the
silc client add client, silc client update client, and silc client nickname format functions.Recommendations
For SILC Toolkit versions prior to 1.1.10, update to version 1.1.10 or later to resolve the issue.
For SILC Client versions prior to 1.1.8, update to version 1.1.8 or later to resolve the issue.
As a temporary workaround, consider restricting access to the vulnerable
silc client add client, silc client update client, and silc client nickname format functions until a patch is available.Fix
Use of Externally-Controlled Format String
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Silc Client
Silc Toolkit