The silc_pkcs1_decode function in the silccrypt library (silcpkcs1.c) in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.7, SILC Client before 1.1.4, and SILC Server before 1.1.2 allows remote attackers to execute arbitrary code via a crafted PKCS#1 message, which triggers an integer underflow, signedness error, and a buffer overflow. NOTE: the researcher describes this as an integer overflow, but CVE uses the "underflow" term in cases of wraparound from unsigned subtraction.

A vulnerability was found in the SILC toolkit before version 1.1.5 that allowed a remote attacker to cause a denial of service (crash), or possibly execute arbitrary code via long input data (CVE-2008-1227).

A vulnerability was found in the SILC toolkit before version 1.1.7 that allowed a remote attacker to execute arbitrary code via a crafted PKCS#2 message (CVE-2008-1552).

The updated packages have been patched to correct these issues.

The remote host is affected by the vulnerability described in GLSA-200804-27 (SILC: Multiple vulnerabilities)

    Nathan G. Grennan reported a boundary error in SILC Toolkit     within the silc_fingerprint() function in the file     lib/silcutil/silcutil.c when passing overly long data, resulting in a     stack-based buffer overflow (CVE-2008-1227).
    A vulnerability     has been reported in SILC Server which is caused due to an error in the     handling of 'NEW_CLIENT' packets that do not contain a nickname     (CVE-2008-1429).
    Ariel Waissbein, Pedro Varangot, Martin     Mizrahi, Oren Isacson, Carlos Garcia, and Ivan Arce of Core Security     Technologies reported that SILC Client, Server, and Toolkit contain a     vulnerability in the silc_pkcs1_decode() function in the silccrypt     library (silcpkcs1.c), resulting in an integer underflow, signedness     error, and a buffer overflow (CVE-2008-1552).
  Impact :

    A remote attacker could exploit these vulnerabilities to cause a Denial     of Service or execute arbitrary code with the privileges of the user     running the application.
  Workaround :

    There is no known workaround at this time.

Core Security Technologies reports :

A remote buffer overflow vulnerability found in a library used by both the SILC server and client to process packets containing cryptographic material may allow an un-authenticated client to executearbitrary code on the server with the privileges of the user account running the server, or a malicious SILC server to compromise client systems and execute arbitrary code with the privileges of the user account running the SILC client program.

This update fixes a buffer overflow in PKCS#1 message decoding

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
36632	Mandriva Linux Security Advisory : silc-toolkit (MDVSA-2008:158)	Nessus	Mandriva Local Security Checks	high
32073	GLSA-200804-27 : SILC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
31693	FreeBSD : silc -- pkcs_decode buffer overflow (ff304c35-fb5b-11dc-91c1-00e0815b8da8)	Nessus	FreeBSD Local Security Checks	medium
31669	Fedora 8 : libsilc-1.0.2-6.fc8 (2008-2641)	Nessus	Fedora Local Security Checks	medium
31666	Fedora 7 : libsilc-1.0.2-6.fc7 (2008-2616)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2008-1552

critical

Tenable Plugins

high

high

medium

medium

medium