CVE-2008-2235 OpenSC before 0.11.5 uses weak permissions (ADMIN file control information of 00) for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proxima...
MediumCVSS 4.9
EPSS 0.41%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenSC before 0.11.5 uses weak permissions (ADMIN file control information of 00) for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proximate attackers to change the PIN.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opensc-project opensc | = 0.3.2 | No fix listed |
| opensc-project opensc | = 0.3.5 | No fix listed |
| opensc-project opensc | = 0.4.0 | No fix listed |
| opensc-project opensc | = 0.6.0 | No fix listed |
| opensc-project opensc | = 0.6.1 | No fix listed |
| opensc-project opensc | = 0.7.0 | No fix listed |
| opensc-project opensc | = 0.8 | No fix listed |
| opensc-project opensc | = 0.8.0.0 | No fix listed |
| opensc-project opensc | = 0.8.1 | No fix listed |
| opensc-project opensc | = 0.9 | No fix listed |
| opensc-project opensc | = 0.9.6 | No fix listed |
| opensc-project opensc | = 0.9.7 | No fix listed |
| opensc-project opensc | = 0.9.7-b | No fix listed |
| opensc-project opensc | = 0.9.7-d | No fix listed |
| opensc-project opensc | = 0.9.8 | No fix listed |
| opensc-project opensc | = 0.11.0 | No fix listed |
| opensc-project opensc | = 0.11.1 | No fix listed |
| opensc-project opensc | = 0.11.2 | No fix listed |
| opensc-project opensc | = 0.11.3 | No fix listed |
| opensc-project opensc | = 0.11.3-pre3 | No fix listed |
| opensc-project opensc | = 0.11.4 | No fix listed |
| debian/opensc(Debian:12) | < 0.11.4-4 | 0.11.4-4 |
| debian/opensc(Debian:13) | < 0.11.4-4 | 0.11.4-4 |
| debian/opensc(Debian:14) | < 0.11.4-4 | 0.11.4-4 |
References
- SUSE-SR:2008:019 vendor-advisory
- SUSE-SR:2009:004 vendor-advisory
- 31330 third-party-advisory
- 31360 third-party-advisory
- 32099 third-party-advisory
- 33115 third-party-advisory
- 34362 third-party-advisory
- GLSA-200812-09 vendor-advisory
- MDVSA-2008:183 vendor-advisory
- [opensc-announce] 20080731 OpenSC Security Vulnerability and new Versions of OpenSC, OpenCT, LibP11, Pam_P11, Engine_PKCS11 mailing-list
- www.opensc-project.org
- 30473 patch vdb-entry
- opensc-smartcard-cryptotoken-weak-security(44140) vdb-entry
- DSA-1627 vendor-advisory
- FEDORA-2009-2267 vendor-advisory
- Debian Security Tracker CVE-2008-2235 vendor-advisory