Bug 521256 – CVE-2008-7160 libsilc: stack corruption in SilcHttpServer on 64bit archs

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 521256 - (CVE-2008-7160) CVE-2008-7160 libsilc: stack corruption in SilcHttpServer on 64bit archs

Summary:	CVE-2008-7160 libsilc: stack corruption in SilcHttpServer on 64bit archs

Status:	CLOSED ERRATA

Aliases:	CVE-2008-7160

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	source=osssecurity,impact=moderate,re...
Keywords:	Security

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2009-09-04 10:46 EDT by Tomas Hoger
Modified:	2009-09-10 02:17 EDT (History)
CC List:	2 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2009-09-10 02:17:26 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Tomas Hoger 2009-09-04 10:46:40 EDT

SILC Toolkit 1.1.9 fixed following issue:

  http://silcnet.org/docs/changelog/SILC%20Toolkit%201.1.9

    HTTP: fix stack overwrite due to format string error.
    
    On AMD64, %lu refers to a 64-bit unsigned value, but the address passed
    to sscanf points to a 32-bit unsigned value.  This causes an adjoining
    value on the stack to be overwritten with data from the converted
    integer.  Fix the format string to match the size of the supplied value,
    and remove the pointer cast.

Upstream fix:
http://git.silcnet.org/gitweb/?p=silc.git;a=commitdiff;h=b2b91b074b6701455053425b583a6fd0beedc8cc

SILC's SilcHttpServer library is include in Fedora libsilc packages, but does not seem to be used by rest of the library, or by pidgin / libpurpe, which should be the only application in Fedora using this library.  This may affect other applications using libsilc.

This does not affect libsilc packages shipped in Red Hat Enterprise Linux 4 and 5, as they do not include SILC HTTP server implementation.

Comment 1 Fedora Update System 2009-09-04 13:41:58 EDT

libsilc-1.1.8-7.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/libsilc-1.1.8-7.fc11

Comment 2 Fedora Update System 2009-09-04 13:41:58 EDT

libsilc-1.1.8-7.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/libsilc-1.1.8-7.fc10

Comment 3 Fedora Update System 2009-09-09 23:42:40 EDT

libsilc-1.1.8-7.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2009-09-09 23:44:01 EDT

libsilc-1.1.8-7.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.