PT-2010-1705 · Muscle · Pcsc-Lite

Vincent Danen · Publicado 2010-06-18 · Atualizado 2010-08-12 · CVE-2009-4902

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MUSCLE PCSC-Lite versions 1.5.4 and earlier

Description A buffer overflow issue exists in the MSGFunctionDemarshall function in winscard svc.c, which is part of the PC/SC Smart Card daemon. This could allow local users to gain privileges by sending crafted SCARD CONTROL message data that is not properly demarshalled.

Recommendations For MUSCLE PCSC-Lite versions 1.5.4 and earlier, consider restricting access to the MSGFunctionDemarshall function until a proper fix is applied. As a temporary workaround, avoid using the SCARD CONTROL message with crafted data to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2009-4902

Produtos afetados

Pcsc-Lite

Referências · 12

• http://securityfocus.com/bid/40758 · Nota
• http://svn.debian.org/wsvn/pcsclite/?sc=1&rev=4334 · Nota
• http://debian.org/security/2010/dsa-2059 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=596426 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4902 · Nota de Segurança
• http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044124.html · Aviso do Fabricante
• http://vupen.com/english/advisories/2010/1508 · Aviso do Fabricante
• http://secunia.com/advisories/40239 · Aviso do Fabricante
• http://secunia.com/advisories/40140 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042921.html · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042900.html · Aviso do Fabricante
• http://vupen.com/english/advisories/2010/1427 · Aviso do Fabricante