PT-2010-5623 · Muscle+1 · Pcsc-Lite+1

Jan Lieskovsky · Published 1970-01-01 · Updated 2016-12-08 · CVE-2010-0407

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PCSC-Lite versions prior to 1.5.4

Description The issue is related to multiple buffer overflows in the MSGFunctionDemarshall function in winscard svc.c in the PC/SC Smart Card daemon. This can allow local users to gain privileges via crafted message data, which is improperly demarshalled. The vulnerability may lead to a violation of confidentiality, integrity, and availability of protected information.

Recommendations For versions prior to 1.5.4, update to version 1.5.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the PC/SC Smart Card daemon to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-01171

BDU:2015-01172

BDU:2015-01173

CVE-2010-0407

DSA-2059-1

OPENSUSE-SU-2024:10246-1

RHSA-2010:0533

RHSA-2010:0602

RHSA-2010_0533

Affected Products

Pcsc-Lite

Red Hat

References · 26

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0407 · Security Note
• http://secunia.com/advisories/40140 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042921.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044124.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=596426 · Patch
• http://securityfocus.com/bid/40758 · Patch
• https://bdu.fstec.ru/vul/2015-01173 · Security Note
• https://bdu.fstec.ru/vul/2015-01171 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-0407 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01172 · Security Note
• http://secunia.com/advisories/40239 · Vendor Advisory
• http://vupen.com/english/advisories/2010/1508 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042900.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-0407 · Vendor Advisory