Format string vulnerability

A friend of mine and myself uncovered a format string vulnerability in
the silc-toolkit. It's not immediately apparent, since silc-client
filters it out, and because the current silc-toolkit would itself be
exploited, but printf format controls can be inserted into nicknames,
allowing an attacker to read from, and write to arbitrary memory
locations (though, only printable shellcode could be used, unless the
UTF8 check is client side only (!)).

I have written a patch which corrects this issue, however I did not
probe for further format string vulnerabilities.

http://spanning-tree.org/~will/client_entry.c.diff

_______________________________________________________________________
Info:    https://lists.silcnet.org/mailman/listinfo/silc-announce
Archive: https://lists.silcnet.org/pipermail/silc-announce
FAQ:     http://silcnet.org/support/faq/