OpenSC before 0.11.5 uses weak permissions (ADMIN file control information of 00) for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proximate attackers to change the PIN.

This update fixes a security issues with opensc that occured when initializing blank smart cards with Siemens CardOS M4. After the initialization anyone could set the PIN of the smart card without authorization. (CVE-2008-2235)

NOTE: Already initialized cards are still vulnerable after this update. Please use the command-line tool pkcs15-tool with option

-test-update and --update when necessary. Don't forget to reinitialize your smart cards if you are using cards with Siemens CardOS M4 operating system that were initialized using opensc!

Please find more information at http://www.opensc-project.org/security.html

This is the second attempt to fix this problem. The previous update was unforunately incomplete.

This revised update fixes a security issue with opensc that occurs when initializing blank smart cards with Siemens CardOS M4. After initialization, anyone could set the PIN of the smart card without authorization. (CVE-2008-2235)

NOTE: cards already initialized with the old version are still vulnerable after this update. Please use the command-line tool pkcs15-tool with the options --test-update and --update if necessary.

Please find more information at http://www.opensc-project.org/security.html

This update fix a security issues with opensc that occurs during initializing blank smart cards with Siemens CardOS M4. It allows to set the PIN of the smart card without authorization. (CVE-2008-2235)

NOTE: Already initialized cards are still vulnerable after this update. Please use the command-line tool pkcs15-tool with option
--test-update and --update when necessary.

This update fixes a security issues with opensc that occured when initializing blank smart cards with Siemens CardOS M4. After the initialization anyone could set the PIN of the smart card without authorization (CVE-2008-2235).

NOTE: Already initialized cards are still vulnerable after this update. Please use the command-line tool pkcs15-tool with option

--test-update and --update when necessary.

Please find more information at http://www.opensc-project.org/security.html

This is the second attempt to fix this problem. The previous update was unforunately incomplete.

This update fixes a security issues with opensc that occurs during initializing blank smart cards with Siemens CardOS M4. It allows to set the PIN of the smart card without authorization. (CVE-2008-2235)

NOTE: Already initialized cards are still vulnerable after this update. Please use the command-line tool pkcs15-tool with option
--test-update and --update when necessary.

Chaskiel M Grundman found that OpenSC would initialize smart cards with the Siemens CardOS M4 card operating system without proper access rights. This allowed everyone to change the card's PIN without first having the PIN or PUK, or the superuser's PIN or PUK (CVE-2008-2235).

Please note that this issue can not be used to discover the PIN on a card. If the PIN on a card is the same that was always there, it is unlikely that this vulnerability has been exploited. As well, this issue only affects smart cards and USB crypto tokens based on Siemens CardOS M4, and then only those devices that were initialized by OpenSC. Users of other smart cards or USB crypto tokens, or cards that were not initialized by OpenSC, are not affected.

After applying the update, executing 'pkcs15-tool -T' will indicate whether the card is fine or vulnerable. If the card is vulnerable, the security settings need to be updated by executing 'pkcs15-tool -T -U'.

The updated packages have been patched to prevent this issue.

Security update fixing CVE-2008-3972, CVE-2008-2235, and CVE-2009-0368.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200812-09 (OpenSC: Insufficient protection of smart card PIN)

    Chaskiel M Grundman reported that OpenSC uses weak permissions (ADMIN     file control information of 00) for the 5015 directory on smart cards     and USB crypto tokens running Siemens CardOS M4.
  Impact :

    A physically proximate attacker can exploit this vulnerability to     change the PIN on a smart card and use it for authentication, leading     to privilege escalation.
  Workaround :

    There is no known workaround at this time.

This update fixes a security issues with opensc that occured when initializing blank smart cards with Siemens CardOS M4. After the initialization anyone could set the PIN of the smart card without authorization. (CVE-2008-2235)

NOTE: Already initialized cards are still vulnerable after this update. Please use the command-line tool pkcs15-tool with option

-test-update and --update when necessary. Please find more information at http://www.opensc-project.org/security.html

This is the second attempt to fix this problem. The previous update was unforunately incomplete.

Chaskiel M Grundman discovered that opensc, a library and utilities to handle smart cards, would initialise smart cards with the Siemens CardOS M4 card operating system without proper access rights. This allowed everyone to change the card's PIN.

With this bug anyone can change a user PIN without having the PIN or PUK or the superusers PIN or PUK. However it can not be used to figure out the PIN. If the PIN on your card is still the same you always had, there's a reasonable chance that this vulnerability has not been exploited.

This vulnerability affects only smart cards and USB crypto tokens based on Siemens CardOS M4, and within that group only those that were initialised with OpenSC. Users of other smart cards and USB crypto tokens, or cards that have been initialised with some software other than OpenSC, are not affected.

After upgrading the package, runningpkcs15-tool -Twill show you whether the card is fine or vulnerable. If the card is vulnerable, you need to update the security setting using:pkcs15-tool -T -U.

ID	Name	Product	Family	Severity
41567	SuSE 10 Security Update : opensc (ZYPP Patch Number 5910)	Nessus	SuSE Local Security Checks	medium
41241	SuSE9 Security Update : opensc, opensc-devel (YOU Patch Number 12240)	Nessus	SuSE Local Security Checks	medium
41230	SuSE9 Security Update : opensc (YOU Patch Number 12216)	Nessus	SuSE Local Security Checks	medium
40030	openSUSE Security Update : libopensc2 (libopensc2-186)	Nessus	SuSE Local Security Checks	medium
40029	openSUSE Security Update : libopensc2 (libopensc2-130)	Nessus	SuSE Local Security Checks	medium
37949	Mandriva Linux Security Advisory : opensc (MDVSA-2008:183)	Nessus	Mandriva Local Security Checks	medium
35959	Fedora 9 : opensc-0.11.7-1.fc9 (2009-2267)	Nessus	Fedora Local Security Checks	medium
35084	GLSA-200812-09 : OpenSC: Insufficient protection of smart card PIN	Nessus	Gentoo Local Security Checks	medium
34262	SuSE 10 Security Update : opensc, opensc-devel (ZYPP Patch Number 5588)	Nessus	SuSE Local Security Checks	medium
34261	openSUSE 10 Security Update : libopensc2 (libopensc2-5587)	Nessus	SuSE Local Security Checks	medium
34078	SuSE 10 Security Update : opensc (ZYPP Patch Number 5493)	Nessus	SuSE Local Security Checks	medium
34073	openSUSE 10 Security Update : libopensc2 (libopensc2-5494)	Nessus	SuSE Local Security Checks	medium
33826	Debian DSA-1627-2 : opensc - programming error	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2008-2235

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium