silc-client silc-toolkit - arbitrary code execution

Several vulnerabilities have been discovered in the software suite for the
SILC protocol, a network protocol designed to provide end-to-end security
for conferencing services. The Common Vulnerabilities and Exposures
project identifies the following problems:

• CVE-2008-7159
  An incorrect format string in sscanf() used in the ASN1 encoder to scan an
  OID value could overwrite a neighbouring variable on the stack as the
  destination data type is smaller than the source type on 64-bit. On 64-bit
  architectures this could result in unexpected application behaviour or even
  code execution in some cases.
• CVE-2009-3051
  Various format string vulnerabilities when handling parsed SILC messages
  allow an attacker to execute arbitrary code with the rights of the victim
  running the SILC client via crafted nick names or channel names containing
  format strings.
• CVE-2008-7160
  An incorrect format string in a sscanf() call used in the HTTP server
  component of silcd could result in overwriting a neighbouring variable on
  the stack as the destination data type is smaller than the source type on
  64-bit. An attacker could exploit this by using crafted Content-Length
  header values resulting in unexpected application behaviour or even code
  execution in some cases.

silc-server doesn’t need an update as it uses the shared library provided
by silc-toolkit. silc-client/silc-toolkit in the oldstable distribution
(etch) is not affected by this problem.

For the stable distribution (lenny), this problem has been fixed in
version 1.1.7-2+lenny1 of silc-toolkit and in version 1.1.4-1+lenny1
of silc-client.

For the testing distribution (squeeze), this problem will be fixed soon.

For the unstable distribution (sid), this problem has been fixed in
version 1.1.10-1 of silc-toolkit and version 1.1-2 of silc-client
(using libsilc from silc-toolkit since this upload).

We recommend that you upgrade your silc-toolkit/silc-client packages.