OpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements and read private data objects via a (1) low level APDU command or (2) debugging tool, as demonstrated by reading the 4601 or 4701 file with the opensc-explorer or opensc-tool program.

Private data objects on smartcards initialized with OpenSC could be accessed without authentication. (CVE-2009-0368)

Only blank cards initialized with OpenSC are affected by this problem.
Affected cards need to be manually fixed, updating the opensc package alone is not sufficient!

Please carefully read and follow the instructions on the following website if you are using PIN protected private data objects on smart cards other than Oberthur, and you have initialized those cards using OpenSC: http://en.opensuse.org/Smart_Cards/Advisories

The remote host is affected by the vulnerability described in GLSA-200908-01 (OpenSC: Multiple vulnerabilities)

    Multiple vulnerabilities were found in OpenSC:
    b.badrignans discovered that OpenSC incorrectly initialises private     data objects (CVE-2009-0368).
    Miquel Comas Marti discovered     that src/tools/pkcs11-tool.c in pkcs11-tool in OpenSC 0.11.7, when used     with unspecified third-party PKCS#11 modules, generates RSA keys with     incorrect public exponents (CVE-2009-1603).
  Impact :

    The first vulnerability allows physically proximate attackers to bypass     intended PIN requirements and read private data objects. The second     vulnerability allows attackers to read the cleartext form of messages     that were intended to be encrypted.
    NOTE: Smart cards which were initialised using an affected version of     OpenSC need to be modified or re-initialised. See the vendor's advisory     for details.
  Workaround :

    There is no known workaround at this time.

Private data objects on smartcards initialized with OpenSC could be accessed without authentication (CVE-2009-0368).

Only blank cards initialized with OpenSC are affected by this problem.
Affected cards need to be manually fixed, updating the opensc package alone is not sufficient!

Please carefully read and follow the instructions on the following website if you are using PIN protected private data objects on smart cards other than Oberthur, and you have initialized those cards using OpenSC: http://en.opensuse.org/Smart_Cards/Advisories

Security update fixing CVE-2009-0368.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

OpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements and read private data objects via a (1) low level APDU command or (2) debugging tool, as demonstrated by reading the 4601 or 4701 file with the opensc-explorer or opensc-tool program.

The updated packages fix the issue.

Security update fixing CVE-2008-3972, CVE-2008-2235, and CVE-2009-0368.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

b.badrignans discovered that OpenSC, a set of smart card utilities, could stores private data on a smart card without proper access restrictions.

Only blank cards initialised with OpenSC are affected by this problem.
This update only improves creating new private data objects, but cards already initialised with such private data objects need to be modified to repair the access control conditions on such cards. Instructions for a variety of situations can be found at the OpenSC website:
http://www.opensc-project.org/security.html

The oldstable distribution (etch) is not affected by this problem.

ID	Name	Product	Family	Severity
41568	SuSE 10 Security Update : OpenSC (ZYPP Patch Number 6053)	Nessus	SuSE Local Security Checks	low
41422	SuSE 11 Security Update : OpenSC (SAT Patch Number 641)	Nessus	SuSE Local Security Checks	low
40462	GLSA-200908-01 : OpenSC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
40258	openSUSE Security Update : libopensc2 (libopensc2-598)	Nessus	SuSE Local Security Checks	low
40031	openSUSE Security Update : libopensc2 (libopensc2-598)	Nessus	SuSE Local Security Checks	low
38662	openSUSE 10 Security Update : libopensc2 (libopensc2-6071)	Nessus	SuSE Local Security Checks	low
37543	Fedora 10 : opensc-0.11.7-1.fc10 (2009-2266)	Nessus	Fedora Local Security Checks	low
36781	Mandriva Linux Security Advisory : opensc (MDVSA-2009:089)	Nessus	Mandriva Local Security Checks	low
35959	Fedora 9 : opensc-0.11.7-1.fc9 (2009-2267)	Nessus	Fedora Local Security Checks	medium
35790	Debian DSA-1734-1 : opensc - programming error	Nessus	Debian Local Security Checks	low

Detections

Analytics

CVE-2009-0368

medium

Tenable Plugins

low

low

medium

low

low

low

low

low

medium

low