The silc_http_server_parse function in lib/silchttp/silchttpserver.c in the internal HTTP server in silcd in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.9 allows remote attackers to overwrite a stack location and possibly execute arbitrary code via a crafted Content-Length header, related to incorrect use of a %lu format string.

The remote host is affected by the vulnerability described in GLSA-201006-07 (SILC: Multiple vulnerabilities)

    Multiple vulnerabilities were discovered in SILC Toolkit and SILC     Client. For further information please consult the CVE entries     referenced below.
  Impact :

    A remote attacker could overwrite stack locations and possibly execute     arbitrary code via a crafted OID value, Content-Length header or format     string specifiers in a nickname field or channel name.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in the software suite for the SILC protocol, a network protocol designed to provide end-to-end security for conferencing services. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-7159     An incorrect format string in sscanf() used in the ASN1     encoder to scan an OID value could overwrite a     neighbouring variable on the stack as the destination     data type is smaller than the source type on 64-bit. On     64-bit architectures this could result in unexpected     application behaviour or even code execution in some     cases.

  - CVE-2009-3051     Various format string vulnerabilities when handling     parsed SILC messages allow an attacker to execute     arbitrary code with the rights of the victim running the     SILC client via crafted nick names or channel names     containing format strings.

  - CVE-2008-7160     An incorrect format string in a sscanf() call used in     the HTTP server component of silcd could result in     overwriting a neighbouring variable on the stack as the     destination data type is smaller than the source type on     64-bit. An attacker could exploit this by using crafted     Content-Length header values resulting in unexpected     application behaviour or even code execution in some     cases.

silc-server doesn't need an update as it uses the shared library provided by silc-toolkit. silc-client/silc-toolkit in the oldstable distribution (etch) is not affected by this problem.

This update of slic-toolkit fixes stack-based overflow while encoding a ASN.1 OID (CVE-2008-7159) and several format string bugs (CVE-2009-3051, CVE-2008-7160). The probability to exploit this issues to execute arbitrary code is high.

This update of slic-toolkit fixes stack-based overflow while encoding a ASN.1 OID (CVE-2008-7159) and several format string bugs (CVE-2009-3051 / CVE-2008-7160). The probability to exploit this issues to execute arbitrary code is high.

Multiple vulnerabilities was discovered and corrected in silc-toolkit :

Multiple format string vulnerabilities in lib/silcclient/client_entry.c in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.10, and SILC Client before 1.1.8, allow remote attackers to execute arbitrary code via format string specifiers in a nickname field, related to the (1) silc_client_add_client, (2) silc_client_update_client, and (3) silc_client_nickname_format functions (CVE-2009-3051).

The silc_asn1_encoder function in lib/silcasn1/silcasn1_encode.c in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.8 allows remote attackers to overwrite a stack location and possibly execute arbitrary code via a crafted OID value, related to incorrect use of a %lu format string (CVE-2008-7159).

The silc_http_server_parse function in lib/silchttp/silchttpserver.c in the internal HTTP server in silcd in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.9 allows remote attackers to overwrite a stack location and possibly execute arbitrary code via a crafted Content-Length header, related to incorrect use of a %lu format string (CVE-2008-7160).

Multiple format string vulnerabilities in lib/silcclient/command.c in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.10, and SILC Client 1.1.8 and earlier, allow remote attackers to execute arbitrary code via format string specifiers in a channel name, related to (1) silc_client_command_topic, (2) silc_client_command_kick, (3) silc_client_command_leave, and (4) silc_client_command_users (CVE-2009-3163).

This update provides a solution to these vulnerabilities.

Update :

Packages for MES5 was not provided previousely, this update addresses this problem.

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

- Fri Sep 4 2009 Stu Tomlinson <stu at nosnilmot.com>     1.1.8-7

    - Backport patch to fix stack corruption (CVE-2008-7160)       (#521256)

    - Fri Sep 4 2009 Stu Tomlinson <stu at nosnilmot.com>       1.1.8-6

    - Backport patch to fix additional string format       vulnerabilities (#515648)

    - Wed Aug 5 2009 Stu Tomlinson <stu at nosnilmot.com>       1.1.8-5

    - Backport patch to fix string format vulnerability       (#515648)

    - Sat Jul 25 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1.1.8-4

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild

    - Wed Feb 25 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1.1.8-3

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

    - Tue Dec 23 2008 Stu Tomlinson <stu at nosnilmot.com>       1.1.8-2

    - Fix building with libtool 2.2

    - Wed Dec 3 2008 Stu Tomlinson <stu at nosnilmot.com>       1.1.8-1

    - Update to 1.1.8

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fri Sep 4 2009 Stu Tomlinson <stu at nosnilmot.com>     1.1.8-7

    - Backport patch to fix stack corruption (CVE-2008-7160)       (#521256)

    - Fri Sep 4 2009 Stu Tomlinson <stu at nosnilmot.com>       1.1.8-6

    - Backport patch to fix additional string format       vulnerabilities (#515648)

    - Wed Aug 5 2009 Stu Tomlinson <stu at nosnilmot.com>       1.1.8-5

    - Backport patch to fix string format vulnerability       (#515648)

    - Sat Jul 25 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1.1.8-4

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
46774	GLSA-201006-07 : SILC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
44744	Debian DSA-1879-1 : silc-client/silc-toolkit - several vulnerabilities	Nessus	Debian Local Security Checks	high
42033	openSUSE 10 Security Update : silc-toolkit (silc-toolkit-6479)	Nessus	SuSE Local Security Checks	high
41453	SuSE 11 Security Update : silc-toolkit (SAT Patch Number 1282)	Nessus	SuSE Local Security Checks	high
41005	openSUSE Security Update : silc-toolkit (silc-toolkit-1280)	Nessus	SuSE Local Security Checks	high
41003	openSUSE Security Update : silc-toolkit (silc-toolkit-1280)	Nessus	SuSE Local Security Checks	high
40997	Mandriva Linux Security Advisory : silc-toolkit (MDVSA-2009:234-2)	Nessus	Mandriva Local Security Checks	high
40909	Fedora 10 : libsilc-1.1.8-7.fc10 (2009-9356)	Nessus	Fedora Local Security Checks	medium
40908	Fedora 11 : libsilc-1.1.8-7.fc11 (2009-9342)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2008-7160

critical

Tenable Plugins

high

high

high

high

high

high

high

medium

medium