CVE-2009-3163

Published: Sep 10, 2009Modified: Apr 23, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Multiple format string vulnerabilities in lib/silcclient/command.c in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.10, and SILC Client 1.1.8 and earlier, allow remote attackers to execute arbitrary code via format string specifiers in a channel name, related to (1) silc_client_command_topic, (2) silc_client_command_kick, (3) silc_client_command_leave, and (4) silc_client_command_users.

Affected (16)

Products: Silcnet: Silc Client, Silc Toolkit

2 products

Configuration A

16 vulnerable

Vulnerable Software	Affected Versions
Silcnet Silc Client	Up to 1.1.8
Silcnet Silc Client	Version 1.1.1
Silcnet Silc Client	Version 1.1.2
Silcnet Silc Client	Version 1.1.3
Silcnet Silc Client	Version 1.1.4
Silcnet Silc Client	Version 1.1.6
Silcnet Silc Client	Version 1.1.7
Silcnet Silc Toolkit	Up to 1.1.9
Silcnet Silc Toolkit	Version 1.1.1
Silcnet Silc Toolkit	Version 1.1.2
Silcnet Silc Toolkit	Version 1.1.3
Silcnet Silc Toolkit	Version 1.1.4
Silcnet Silc Toolkit	Version 1.1.5
Silcnet Silc Toolkit	Version 1.1.6
Silcnet Silc Toolkit	Version 1.1.8
Silcnet Silc Toolkit	Version 1.1

Related CWEs

Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

References (18)

http://secunia.com/advisories/36614

Source: cve@mitre.org

Vendor Advisory

http://silcnet.org/docs/changelog/SILC%20Toolkit%201.1.10

Source: cve@mitre.org

http://silcnet.org/general/news/news_toolkit.php

Source: cve@mitre.org

http://www.debian.org/security/2009/dsa-1879

Source: cve@mitre.org

Vendor Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2009:234

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2009:235

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2009/08/31/5

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2009/09/03/5

Source: cve@mitre.org

http://www.securityfocus.com/bid/36193

Source: cve@mitre.org

http://secunia.com/advisories/36614

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://silcnet.org/docs/changelog/SILC%20Toolkit%201.1.10

Source: af854a3a-2127-422b-91ae-364da2661108

http://silcnet.org/general/news/news_toolkit.php

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2009/dsa-1879

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2009:234

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2009:235

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2009/08/31/5

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2009/09/03/5

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/36193

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.