PT-2009-1008 · Opensc+2 · Opensc+2

B.Badrignans · Published 2009-03-02 · Updated 2024-06-15 · CVE-2009-0368

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenSC versions prior to 0.11.8 OpenSC versions prior to 0.11.7

Description The issue affects the opensc package in Gentoo Linux and Debian GNU/Linux operating systems, potentially leading to a breach of protected information confidentiality. Exploitation can be performed remotely or by a local attacker. Specifically, it allows physically proximate attackers to bypass intended PIN requirements and read private data objects via low-level APDU commands or debugging tools.

Recommendations For versions prior to 0.11.7, consider restricting access to debugging tools and low-level APDU commands to minimize the risk of exploitation. For versions prior to 0.11.8, update to version 0.11.8 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-310

Related Identifiers

BDU:2015-01770

BDU:2015-09379

CVE-2009-0368

DSA-1734-1

OPENSUSE-SU-2024:10269-1

Affected Products

Debian

Gentoo Linux

Opensc

References · 27

• 🔥 https://exploit-db.com/exploits/32820 · Exploit
• 🔥 http://securityfocus.com/bid/33922 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0368 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2009-0368 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01770 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10269-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0368 · Security Note
• http://openwall.com/lists/oss-security/2009/02/26/1 · Patch
• http://opensc-project.org/pipermail/opensc-announce/2009-February/000023.html · Vendor Advisory
• http://secunia.com/advisories/34052 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200908-01.xml · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-0368 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09379 · Security Note
• http://debian.org/security/2009/dsa-1734 · Vendor Advisory