Some vulnerabilities have been reported in SILC Toolkit and SILC Server, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.

1) An incorrect format specifier within the "silc_asn1_encoder()" function in lib/silcasn1/silcasn1_encode.c can be exploited to cause a memory corruption.

Successful exploitation requires a 64bit system.

2) An incorrect format specifier within the "silc_http_server_parse()" function in lib/silchttp/silchttpserver.c can be exploited to cause a memory corruption by sending specially crafted requests to a vulnerable HTTP server.

Successful exploitation requires a 64bit system and that e.g. the internal HTTP server for statistics is enabled.

Solution
Update to SILC Toolkit 1.1.10 and SILC Server 1.1.17.
Further details available to Secunia VIM customers

Provided and/or discovered by
Reported by the vendor.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://git.silcnet.org/gitweb/?p=silc.git;a=commitdiff;h=ebfe5dc8641467efea3506a4797a2b1260b2da55
http://git.silcnet.org/gitweb/?p=silc.git;a=commitdiff;h=b2b91b074b6701455053425b583a6fd0beedc8cc

Deep Links
Links available to Secunia VIM customers