Vulnerability Description
The silc_pkcs1_decode function in the silccrypt library (silcpkcs1.c) in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.7, SILC Client before 1.1.4, and SILC Server before 1.1.2 allows remote attackers to execute arbitrary code via a crafted PKCS#1 message, which triggers an integer underflow, signedness error, and a buffer overflow. NOTE: the researcher describes this as an integer overflow, but CVE uses the "underflow" term in cases of wraparound from unsigned subtraction.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Silc | Silc Client | <= 1.1.3 |
| Silc | Silc Server | <= 1.1.2 |
| Silc | Silc Toolkit | <= 1.1.6 |
| Redhat | Fedora | 7 |
| Silc | Silc | All versions |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html
- http://secunia.com/advisories/29463Vendor Advisory
- http://secunia.com/advisories/29465
- http://secunia.com/advisories/29622
- http://secunia.com/advisories/29946
- http://security.gentoo.org/glsa/glsa-200804-27.xml
- http://securityreason.com/securityalert/3795
- http://silcnet.org/general/news/?item=client_20080320_1Patch
- http://silcnet.org/general/news/?item=server_20080320_1Patch
- http://silcnet.org/general/news/?item=toolkit_20080320_1Patch
- http://www.coresecurity.com/?action=item&id=2206
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:158
- http://www.securityfocus.com/archive/1/490069/100/0/threaded
- http://www.securityfocus.com/bid/28373Patch
- http://www.securitytracker.com/id?1019690
FAQ
What is CVE-2008-1552?
CVE-2008-1552 is a vulnerability with a CVSS score of 6.8 (MEDIUM). The silc_pkcs1_decode function in the silccrypt library (silcpkcs1.c) in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.7, SILC Client before 1.1.4, and SILC Server before 1.1.2 allows re...
How severe is CVE-2008-1552?
CVE-2008-1552 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2008-1552?
Check the references section above for vendor advisories and patch information. Affected products include: Silc Silc Client, Silc Silc Server, Silc Silc Toolkit, Redhat Fedora, Silc Silc.