CVE-2009-4902

2010-06-1816:30:00

CWE-119

[email protected]

web.nvd.nist.gov

cve-2009-4902

buffer overflow

pcscd

smart card daemon

muscle pcsc-lite

privilege escalation

vulnerability

6.4 Medium

AI Score

Confidence

Low

6.8 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:S/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

5.3%

JSON

Buffer overflow in the MSGFunctionDemarshall function in winscard_svc.c in the PC/SC Smart Card daemon (aka PCSCD) in MUSCLE PCSC-Lite 1.5.4 and earlier might allow local users to gain privileges via crafted SCARD_CONTROL message data, which is improperly demarshalled. NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-0407.

CPENameOperatorVersion
muscle:pcsc-litemuscle pcsc-liteeq1.2.9
muscle:pcsc-litemuscle pcsc-liteeq1.4.3
muscle:pcsc-litemuscle pcsc-liteeq1.2.0
muscle:pcsc-litemuscle pcsc-liteeq1.3.1
muscle:pcsc-litemuscle pcsc-liteeq1.1.2
muscle:pcsc-litemuscle pcsc-liteeq1.5.1
muscle:pcsc-litemuscle pcsc-liteeq1.3.2
muscle:pcsc-litemuscle pcsc-liteeq1.4.102
muscle:pcsc-litemuscle pcsc-liteeq1.4.100
muscle:pcsc-litemuscle pcsc-liteeq1.4.1

CPE	Name	Operator	Version
muscle:pcsc-lite	muscle pcsc-lite	eq	1.2.9
muscle:pcsc-lite	muscle pcsc-lite	eq	1.4.3
muscle:pcsc-lite	muscle pcsc-lite	eq	1.2.0
muscle:pcsc-lite	muscle pcsc-lite	eq	1.3.1
muscle:pcsc-lite	muscle pcsc-lite	eq	1.1.2
muscle:pcsc-lite	muscle pcsc-lite	eq	1.5.1
muscle:pcsc-lite	muscle pcsc-lite	eq	1.3.2
muscle:pcsc-lite	muscle pcsc-lite	eq	1.4.102
muscle:pcsc-lite	muscle pcsc-lite	eq	1.4.100
muscle:pcsc-lite	muscle pcsc-lite	eq	1.4.1