Description
The silc_pkcs1_decode function in the silccrypt library (silcpkcs1.c) in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.7, SILC Client before 1.1.4, and SILC Server before 1.1.2 allows remote attackers to execute arbitrary code via a crafted PKCS#1 message, which triggers an integer underflow, signedness error, and a buffer overflow. NOTE: the researcher describes this as an integer overflow, but CVE uses the "underflow" term in cases of wraparound from unsigned subtraction.
References
- 29465 third-party-advisory
- 29622 third-party-advisory
- SUSE-SR:2008:008 vendor-advisory
- 1019690 vdb-entry
- GLSA-200804-27 vendor-advisory
- 3795 third-party-advisory
- http://silcnet.org/general/news/?item=server_20080320_1
- 20080325 CORE-2007-1212: SILC pkcs_decode buffer overflow mailing-list
- http://silcnet.org/general/news/?item=toolkit_20080320_1
- 29463 third-party-advisory
- FEDORA-2008-2641 vendor-advisory
- ADV-2008-0974 vdb-entry
- 29946 third-party-advisory
- 28373 vdb-entry
- http://www.coresecurity.com/?action=item&id=2206
- http://silcnet.org/general/news/?item=client_20080320_1
- MDVSA-2008:158 vendor-advisory
- silc-silcpkcs1decode-bo(41474) vdb-entry
- FEDORA-2008-2616 vendor-advisory