blob: 570e7bd02afe06532eabb52f0cc2fedf4652f8fc [file] [log] [blame]
<?xml version="1.0" encoding="utf-8"?>
<glsa id="200703-12">
<title>SILC Server: Denial of Service</title>
SILC Server is affected by a Denial of Service vulnerability.
<product type="ebuild">silc-server</product>
<announced>March 14, 2007</announced>
<revised>March 14, 2007: 01</revised>
<package name="net-im/silc-server" auto="yes" arch="*">
<unaffected range="ge">1.0.2-r1</unaffected>
<vulnerable range="lt">1.0.2-r1</vulnerable>
SILC Server is a server for the Secure Internet Live Conferencing
(SILC) protocol.
Frank Benkstein discovered a possible NULL pointer dereference in
apps/silcd/command.c if a new channel is created without specifying a
valid hmac or cipher algorithm name.
<impact type="normal">
A remote attacker could cause the server to crash, resulting in a
Denial of Service.
There is no known workaround at this time.
All SILC Server users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose &quot;&gt;=net-im/silc-server-1.0.2-r1&quot;</code>
<metadata tag="requester" timestamp="Wed, 07 Mar 2007 14:35:02 +0000">
<metadata tag="bugReady" timestamp="Wed, 07 Mar 2007 14:57:46 +0000">
<metadata tag="submitter" timestamp="Wed, 07 Mar 2007 15:20:03 +0000">