Bug 664999 (CVE-2010-4531)

Summary: CVE-2010-4531 pcsc-lite: Stack-based buffer overflow in Answer-to-Reset (ATR) decoder
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bressers, kalevlember, ludovic.rousseau, rrelyea
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: public=20101213,reported=20101222,source=debian,impact=moderate,cvss2=4.6/AV:L/AC:L/Au:N/C:P/I:P/A:P,rhel-5/pcsc-lite=wontfix,rhel-6/pcsc-lite=affected,fedora-all/pcsc-lite=affected,cwe=CWE-121[auto]
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-03-31 06:06:01 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 665000, 883651    
Bug Blocks: 855229    

Description Jan Lieskovsky 2010-12-22 07:34:01 EST
A stack-based buffer overflow flaw was found in the way
PC/SC Lite smart card framework decoded certain attribute 
values of the Answer-to-Reset (ATR) message, received back
from the card after connecting. A local attacker could
use this flaw to execute arbitrary code with the privileges
of the user running the pcscd daemon, via a malicious smart
card inserted to the system USB port.

[1] http://labs.mwrinfosecurity.com/files/Advisories/mwri_pcsc-atr-handler-buffer-overflow_2010-12-13.pdf
[2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607781
[3] http://www.vupen.com/english/advisories/2010/3264

Upstream changeset:
[4] http://lists.alioth.debian.org/pipermail/pcsclite-cvs-commit/2010-November/004923.html
Comment 1 Jan Lieskovsky 2010-12-22 07:35:54 EST
This issue affects the versions of the pcsc-lite package, as shipped
with Red Hat Enterprise Linux 5 and 6.


This issue affects the versions of the pcsc-lite package, as shipped
with Fedora release of 13 and 14.

Please schedule an update with the above upstream patch.
Comment 2 Jan Lieskovsky 2010-12-22 07:36:57 EST
Created pcsc-lite tracking bugs for this issue

Affects: fedora-all [bug 665000]
Comment 3 Jan Lieskovsky 2010-12-22 07:57:38 EST
CVE Request:
Comment 4 Kalev Lember 2011-01-05 06:35:28 EST
I have submitted updates for Fedora 13 and Fedora 14. In rawhide the version of the pcsc-lite package is newer, containing the upstream patch, and is not affected by the vulnerability.

Comment 9 Tomas Hoger 2013-01-02 10:01:00 EST
(In reply to comment #0)
> http://labs.mwrinfosecurity.com/files/Advisories/mwri_pcsc-atr-handler-
> buffer-overflow_2010-12-13.pdf

Now available via the following URL instead:

Comment 11 errata-xmlrpc 2013-02-21 06:00:16 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2013:0525 https://rhn.redhat.com/errata/RHSA-2013-0525.html
Comment 12 Huzaifa S. Sidhpurwala 2013-02-21 23:10:50 EST