GLSA-200812-09 : OpenSC: Insufficient protection of smart card PIN

The remote host is affected by the vulnerability described in GLSA-200812-09 OpenSC: Insufficient protection of smart card PIN Chaskiel M Grundman reported that OpenSC uses weak permissions ADMIN file control information of 00 for the 5015 directory on smart cards and USB crypto tokens running...

OpenSC: Insufficient protection of smart card PIN

Background OpenSC is a smart card application that allows reading and writing via PKCS11. Description Chaskiel M Grundman reported that OpenSC uses weak permissions ADMIN file control information of 00 for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4. Impact A...

SuSE 10 Security Update : opensc, opensc-devel (ZYPP Patch Number 5588)

This update fixes a security issues with opensc that occured when initializing blank smart cards with Siemens CardOS M4. After the initialization anyone could set the PIN of the smart card without authorization. CVE-2008-2235 NOTE: Already initialized cards are still vulnerable after this update...

Debian Security Advisory DSA 1627-2 (opensc)

The remote host is missing an update to opensc announced via advisory DSA 1627-2. OpenVAS Vulnerability Test $Id: deb16272.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1627-2 opensc Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

openSUSE 10 Security Update : libopensc2 (libopensc2-5494)

This update fixes a security issues with opensc that occurs during initializing blank smart cards with Siemens CardOS M4. It allows to set the PIN of the smart card without authorization. CVE-2008-2235 NOTE: Already initialized cards are still vulnerable after this update. Please use the...

SuSE 10 Security Update : opensc (ZYPP Patch Number 5493)

This update fix a security issues with opensc that occurs during initializing blank smart cards with Siemens CardOS M4. It allows to set the PIN of the smart card without authorization. CVE-2008-2235 NOTE: Already initialized cards are still vulnerable after this update. Please use the command-li...

[SECURITY] [DSA 1627-2] New opensc package fix incomplete check

------------------------------------------------------------------------ Debian Security Advisory DSA-1627-2 [email protected] http://www.debian.org/security/ Thijs Kinkhorst August 31, 2008 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 1627-1 (opensc)

The remote host is missing an update to opensc announced via advisory DSA 1627-1. This VT has been deprecated and merged into the VT SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Debian DSA-1627-2 : opensc - programming error

Chaskiel M Grundman discovered that opensc, a library and utilities to handle smart cards, would initialise smart cards with the Siemens CardOS M4 card operating system without proper access rights. This allowed everyone to change the card's PIN. With this bug anyone can change a user PIN without...

[SECURITY] [DSA 1627-1] New opensc packages fix smart card vulnerability

------------------------------------------------------------------------ Debian Security Advisory DSA-1627-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst August 04, 2008 http://www.debian.org/security/faq -...

OpenSC CardOS M4智能卡不安全权限漏洞

BUGTRAQ ID: 30473 CVE ID：CVE-2008-2235 CNCVE ID：CNCVE-20082235 OpenSC是一款开放源代码的智能卡访问的库和工具集。 OpenSC不安全初始化基于Seimens CardOS M4的智能卡和USB加密令牌，本地攻击者可以利用漏洞无需了解已经存在的PIN或PUK号码就更改卡中的PIN值。 目前没有详细漏洞细节提供。 OpenSC 0.11.4 OpenSC OpenSC 0.11.4 OpenSC opensc-0.11.5.tar.gz...

DSA-1627-2 opensc - smart card vulnerability

Bulletin has no description...

CVE-2008-2235

OpenSC before 0.11.5 uses weak permissions ADMIN file control information of 00 for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proximate attackers to change the PIN...

CVE-2008-2235

OpenSC before 0.11.5 uses weak permissions ADMIN file control information of 00 for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proximate attackers to change the PIN...

Design/Logic Flaw

OpenSC before 0.11.5 uses weak permissions ADMIN file control information of 00 for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proximate attackers to change the PIN...

CVE-2008-2235

OpenSC before 0.11.5 uses weak permissions ADMIN file control information of 00 for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proximate attackers to change the PIN...

CVE-2008-2235

OpenSC (pre-0.11.5) is affected by CVE-2008-2235 due to weak permissions on the 5015 directory for Siemens CardOS M4 smart cards and USB tokens, allowing a physically proximate attacker to change the PIN. The OpenSC/OpenSC-devel packages are the impacted components; the root cause is improper acc...

CVE-2008-2235

OpenSC before 0.11.5 uses weak permissions ADMIN file control information of 00 for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proximate attackers to change the PIN...

CVE-2008-2235

OpenSC before 0.11.5 uses weak permissions ADMIN file control information of 00 for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proximate attackers to change the PIN...

GNU m4格式串及文件名引用漏洞

BUGTRAQ ID: 28688 CVECAN ID: CVE-2008-1687,CVE-2008-1688 GNU M4是广泛应用的GNU宏处理器。 GNU M4的src/freeze.c文件中的producefrozenstate函数存在格式串处理漏洞，如果向m4 -F传送了特制的文件名参数的话，就可能导致执行任意指令。 GNU M4在实现maketemp和mkstemp宏时存在漏洞，如果输出字符串中包含有特殊字符的话，就可能导致处理不正确的文件。 GNU m4 1.4.10 GNU --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...