CVE-2008-1552: Buffer Overflow
The silcpkcs1decode function in the silccrypt library (silcpkcs1.c) in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.7, SILC Client before 1.1.4, and SILC Server before 1.1.2 allows remote attackers to execute arbitrary code via a crafted PKCS#1 message, which triggers an integer underflow, signedness error, and a buffer overflow. NOTE: the researcher describes this as an integer overflow, but CVE uses the "underflow" term in cases of wraparound from unsigned subtraction.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-1552?
CVE-2008-1552 has been rated as a critical severity vulnerability due to its ability to allow remote code execution.
How do I fix CVE-2008-1552?
To fix CVE-2008-1552, upgrade to Secure Internet Live Conferencing (SILC) Toolkit version 1.1.7 or later, SILC Client version 1.1.4 or later, and SILC Server version 1.1.2 or later.
What software is affected by CVE-2008-1552?
CVE-2008-1552 affects SILC Toolkit versions prior to 1.1.7, SILC Client versions prior to 1.1.4, and SILC Server versions prior to 1.1.2.
What types of attacks can CVE-2008-1552 enable?
CVE-2008-1552 can enable remote attackers to execute arbitrary code through crafted PKCS#1 messages.
Is there a workaround for CVE-2008-1552 if I cannot immediately upgrade?
There are no known workarounds for CVE-2008-1552; upgrading to the fixed versions is the recommended solution.