Secunia

A vulnerability has been reported in SILC Client, Server, and Toolkit, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.

The vulnerability is caused due to an integer overflow error in the "silc_pkcs1_decode" function in lib/silccrypt/silcpkcs1.c. This can be exploited to cause a buffer overflow via a specially crafted PKCS#1 block.

The vulnerability is reported in SILC Toolkit prior to 1.1.7, SILC Client prior to 1.1.4, and SILC Server prior to 1.1.2.

Solution
SILC Toolkit:
Further details available in Customer Area

Provided and/or discovered by
Ariel Waissbein, Pedro Varangot, Martin Mizrahi, Oren Isacson, Carlos Garcia, and Ivan Arce of Core Security Technologies.

Changelog
Further details available in Customer Area

Original Advisory
SILC:
http://silcnet.org/general/news/?item=toolkit_20080320_1
http://silcnet.org/general/news/?item=client_20080320_1
http://silcnet.org/general/news/?item=server_20080320_1

Core Security:
http://www.coresecurity.com/?action=item&id=2206

Deep Links
Links available in Customer Area