CVE-2008-1552
Estado: ModificadaMedia (6.8)—
The silc_pkcs1_decode function in the silccrypt library (silcpkcs1.c) in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.7, SILC Client before 1.1.4, and SILC Server before 1.1.2 allows remote attackers to execute arbitrary code via a crafted PKCS#1 message, which triggers an integer underflow, signedness error, and a buffer overflow. NOTE: the researcher describes this as an integer overflow, but CVE uses the "underflow" term in cases of wraparound from unsigned subtraction.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
- Puntuación base: 6.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 4.11%
- Percentil entre todas las CVEs puntuadas: 90
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (4)
CWE
- CWE-189
Referencias
- http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html
- http://secunia.com/advisories/29463
- http://secunia.com/advisories/29465
- http://secunia.com/advisories/29622
- http://secunia.com/advisories/29946
- http://security.gentoo.org/glsa/glsa-200804-27.xml
- http://securityreason.com/securityalert/3795
- http://silcnet.org/general/news/?item=client_20080320_1
- http://silcnet.org/general/news/?item=server_20080320_1
- http://silcnet.org/general/news/?item=toolkit_20080320_1
- http://www.coresecurity.com/?action=item&id=2206
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:158
- http://www.securityfocus.com/archive/1/490069/100/0/threaded
- http://www.securityfocus.com/bid/28373
- http://www.securitytracker.com/id?1019690
- http://www.vupen.com/english/advisories/2008/0974/references
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41474
- https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00513.html
- https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00538.html
- http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html
- http://secunia.com/advisories/29463
- http://secunia.com/advisories/29465
- http://secunia.com/advisories/29622
- http://secunia.com/advisories/29946
- http://security.gentoo.org/glsa/glsa-200804-27.xml
- http://securityreason.com/securityalert/3795
- http://silcnet.org/general/news/?item=client_20080320_1
- http://silcnet.org/general/news/?item=server_20080320_1
- http://silcnet.org/general/news/?item=toolkit_20080320_1
- http://www.coresecurity.com/?action=item&id=2206
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:158
- http://www.securityfocus.com/archive/1/490069/100/0/threaded
- http://www.securityfocus.com/bid/28373
- http://www.securitytracker.com/id?1019690
- http://www.vupen.com/english/advisories/2008/0974/references
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41474
- https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00513.html
- https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00538.html
JSON original (NVD)
Mostrar
{
"id": "CVE-2008-1552",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 6.8,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2008-03-31T17:44:00.000",
"references": [
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/29463",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/29465",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/29622",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/29946",
"source": "cve@mitre.org"
},
{
"url": "http://security.gentoo.org/glsa/glsa-200804-27.xml",
"source": "cve@mitre.org"
},
{
"url": "http://securityreason.com/securityalert/3795",
"source": "cve@mitre.org"
},
{
"url": "http://silcnet.org/general/news/?item=client_20080320_1",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://silcnet.org/general/news/?item=server_20080320_1",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://silcnet.org/general/news/?item=toolkit_20080320_1",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.coresecurity.com/?action=item&id=2206",
"source": "cve@mitre.org"
},
{
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:158",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/archive/1/490069/100/0/threaded",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/28373",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securitytracker.com/id?1019690",
"source": "cve@mitre.org"
},
{
"url": "http://www.vupen.com/english/advisories/2008/0974/references",
"source": "cve@mitre.org"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41474",
"source": "cve@mitre.org"
},
{
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00513.html",
"source": "cve@mitre.org"
},
{
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00538.html",
"source": "cve@mitre.org"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/29463",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/29465",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/29622",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/29946",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://security.gentoo.org/glsa/glsa-200804-27.xml",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://securityreason.com/securityalert/3795",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://silcnet.org/general/news/?item=client_20080320_1",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://silcnet.org/general/news/?item=server_20080320_1",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://silcnet.org/general/news/?item=toolkit_20080320_1",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.coresecurity.com/?action=item&id=2206",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:158",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/archive/1/490069/100/0/threaded",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/28373",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id?1019690",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2008/0974/references",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41474",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00513.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00538.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-189"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The silc_pkcs1_decode function in the silccrypt library (silcpkcs1.c) in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.7, SILC Client before 1.1.4, and SILC Server before 1.1.2 allows remote attackers to execute arbitrary code via a crafted PKCS#1 message, which triggers an integer underflow, signedness error, and a buffer overflow. NOTE: the researcher describes this as an integer overflow, but CVE uses the \"underflow\" term in cases of wraparound from unsigned subtraction."
},
{
"lang": "es",
"value": "La función silc_pkcs1_decode de la librería silccrypt (silcpkcs1.c) en Secure Internet Live Conferencing (SILC) Toolkit antes de 1.1.7, SILC Client antes de 1.1.4 y SILC Server antes de 1.1.2 permite a atacantes remotos ejecutar código de su elección a través de un mensaje PKCS#1 manipulado, lo que dispara un desbordamiento inferior de entero, un error de signo y un desbordamiento de búfer. NOTA: el investigador lo describe como un desbordamiento de entero, pero CVE utiliza el término \"desbordamiento inferior\" en casos de estrechamiento de resta sin signo."
}
],
"lastModified": "2026-06-16T22:51:57.663",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:silc:silc_client:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "17399447-A537-43ED-8F3B-34A6B3775F91",
"versionEndIncluding": "1.1.3"
},
{
"criteria": "cpe:2.3:a:silc:silc_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C79529C3-3305-4C9F-81B9-6A230CEC864B",
"versionEndIncluding": "1.1.2"
},
{
"criteria": "cpe:2.3:a:silc:silc_toolkit:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "29C8F2A5-C309-4BAB-B292-B95BE9BD335B",
"versionEndIncluding": "1.1.6"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:redhat:fedora:7:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "EE2027FA-357A-4BE3-9043-6DE8307C040A"
},
{
"criteria": "cpe:2.3:o:redhat:fedora:8:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C8E8256F-3FB6-45B2-8F03-02A61C10FAF0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:silc:silc:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A363089A-8328-48B1-9609-36A635EC4A46"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"vendorComments": [
{
"comment": "Red Hat does not consider this issue to be a security flaw as SILC is not used in a vulnerable manner in Red Hat Enterprise Linux 4 and 5.\n\nMore information can be found here:\nhttps://bugzilla.redhat.com/show_bug.cgi?id=440049",
"lastModified": "2008-04-23T00:00:00",
"organization": "Red Hat"
}
],
"sourceIdentifier": "cve@mitre.org"
}