PT-2011-1049 · Muscle+2 · Pcsc-Lite+2
Jan Lieskovsky
·
Published
2011-01-18
·
Updated
2023-02-13
·
CVE-2010-4531
CVSS v2.0
4.4
Medium
| Vector | AV:L/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
pcsc-lite versions 1.5.3 through 1.6.6
pcsc-lite versions prior to 1.6.6
Description
The issue affects the pcsc-lite package, potentially leading to breaches of confidentiality, integrity, and availability of protected information. It can be exploited by a local attacker. A stack-based buffer overflow in the ATRDecodeAtr function allows physically proximate attackers to cause a denial of service and possibly execute arbitrary code via a smart card with a long attribute value in its ATR message.
Recommendations
For pcsc-lite versions 1.5.3 through 1.6.6, update to version 1.6.6 or later to resolve the issue.
For pcsc-lite versions prior to 1.6.6, update to version 1.6.6 or later to resolve the issue.
As a temporary workaround, consider restricting access to the
ATRDecodeAtr function in the atrhandler.c file until a patch is available.Fix
DoS
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Centos
Red Hat
Pcsc-Lite