Mandriva Linux Security Advisory : opensc (MDVSA-2008:183)

This script is Copyright (C) 2009-2013 Tenable Network Security, Inc.


Synopsis :

The remote Mandriva Linux host is missing one or more security
updates.

Description :

Chaskiel M Grundman found that OpenSC would initialize smart cards
with the Siemens CardOS M4 card operating system without proper access
rights. This allowed everyone to change the card's PIN without first
having the PIN or PUK, or the superuser's PIN or PUK (CVE-2008-2235).

Please note that this issue can not be used to discover the PIN on a
card. If the PIN on a card is the same that was always there, it is
unlikely that this vulnerability has been exploited. As well, this
issue only affects smart cards and USB crypto tokens based on Siemens
CardOS M4, and then only those devices that were initialized by
OpenSC. Users of other smart cards or USB crypto tokens, or cards that
were not initialized by OpenSC, are not affected.

After applying the update, executing 'pkcs15-tool -T' will indicate
whether the card is fine or vulnerable. If the card is vulnerable, the
security settings need to be updated by executing 'pkcs15-tool -T -U'.

The updated packages have been patched to prevent this issue.

See also :

http://www.opensc-project.org/security.html

Solution :

Update the affected packages.

Risk factor :

Medium / CVSS Base Score : 4.9
(CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:N)

Family: Mandriva Local Security Checks

Nessus Plugin ID: 37949 (mandriva_MDVSA-2008-183.nasl)

Bugtraq ID:

CVE ID: CVE-2008-2235

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now