Nom du paquet
silc-toolkit
Date
2009-12-05
Advisory ID
MDVSA-2009:234-2
Affected versions
2008.0 i586 , 2008.0 x86_64

Problem description

Multiple vulnerabilities was discovered and corrected in silc-toolkit:

Multiple format string vulnerabilities in lib/silcclient/client_entry.c
in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.10, and
SILC Client before 1.1.8, allow remote attackers to execute arbitrary
code via format string specifiers in a nickname field, related to the
(1) silc_client_add_client, (2) silc_client_update_client, and (3)
silc_client_nickname_format functions (CVE-2009-3051).

The silc_asn1_encoder function in lib/silcasn1/silcasn1_encode.c in
Secure Internet Live Conferencing (SILC) Toolkit before 1.1.8 allows
remote attackers to overwrite a stack location and possibly execute
arbitrary code via a crafted OID value, related to incorrect use of
a %lu format string (CVE-2008-7159).

The silc_http_server_parse function in lib/silchttp/silchttpserver.c in
the internal HTTP server in silcd in Secure Internet Live Conferencing
(SILC) Toolkit before 1.1.9 allows remote attackers to overwrite
a stack location and possibly execute arbitrary code via a crafted
Content-Length header, related to incorrect use of a %lu format string
(CVE-2008-7160).

Multiple format string vulnerabilities in lib/silcclient/command.c
in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.10,
and SILC Client 1.1.8 and earlier, allow remote attackers to execute
arbitrary code via format string specifiers in a channel name, related
to (1) silc_client_command_topic, (2) silc_client_command_kick,
(3) silc_client_command_leave, and (4) silc_client_command_users
(CVE-2009-3163).

This update provides a solution to these vulnerabilities.

Update:

Packages for MES5 was not provided previousely, this update addresses
this problem.

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

Updated packages

2008.0 i586

 4deec485d40326e0739b7da3998787ed  2008.0/i586/libsilc-1.1_2-1.1.2-2.2mdv2008.0.i586.rpm
 c3e7b417ad4cbb458e099794cab7405a  2008.0/i586/libsilcclient-1.1_2-1.1.2-2.2mdv2008.0.i586.rpm
 826d5dca133332e52f0f85dad21c940a  2008.0/i586/silc-toolkit-1.1.2-2.2mdv2008.0.i586.rpm
 e5b0fda04c3caa276f3b1756ac838c89  2008.0/i586/silc-toolkit-devel-1.1.2-2.2mdv2008.0.i586.rpm 
 4901eb44eaf1632da20c1e460b23edbc  2008.0/SRPMS/silc-toolkit-1.1.2-2.2mdv2008.0.src.rpm

2008.0 x86_64

 9ee2ebe46efbfc9ae9254dd37312dd69  2008.0/x86_64/lib64silc-1.1_2-1.1.2-2.2mdv2008.0.x86_64.rpm
 351348a77adbcc686df498b9164ffe0c  2008.0/x86_64/lib64silcclient-1.1_2-1.1.2-2.2mdv2008.0.x86_64.rpm
 995aabe91251d812e5b4aa86e5d3e775  2008.0/x86_64/silc-toolkit-1.1.2-2.2mdv2008.0.x86_64.rpm
 a93052fa1de76316511e1867b7295f47  2008.0/x86_64/silc-toolkit-devel-1.1.2-2.2mdv2008.0.x86_64.rpm 
 4901eb44eaf1632da20c1e460b23edbc  2008.0/SRPMS/silc-toolkit-1.1.2-2.2mdv2008.0.src.rpm

References