Bug 664999 - (CVE-2010-4531) CVE-2010-4531 pcsc-lite: Stack-based buffer overflow in Answer-to-Reset (ATR) decoder
CVE-2010-4531 pcsc-lite: Stack-based buffer overflow in Answer-to-Reset (ATR)...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
public=20101213,reported=20101222,sou...
: Security
Depends On: 665000 883651
Blocks: 855229
  Show dependency treegraph
 
Reported: 2010-12-22 07:34 EST by Jan Lieskovsky
Modified: 2016-03-31 06:06 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-03-31 06:06:01 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2010-12-22 07:34:01 EST
A stack-based buffer overflow flaw was found in the way
PC/SC Lite smart card framework decoded certain attribute 
values of the Answer-to-Reset (ATR) message, received back
from the card after connecting. A local attacker could
use this flaw to execute arbitrary code with the privileges
of the user running the pcscd daemon, via a malicious smart
card inserted to the system USB port.

References:
[1] http://labs.mwrinfosecurity.com/files/Advisories/mwri_pcsc-atr-handler-buffer-overflow_2010-12-13.pdf
[2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607781
[3] http://www.vupen.com/english/advisories/2010/3264

Upstream changeset:
[4] http://lists.alioth.debian.org/pipermail/pcsclite-cvs-commit/2010-November/004923.html
Comment 1 Jan Lieskovsky 2010-12-22 07:35:54 EST
This issue affects the versions of the pcsc-lite package, as shipped
with Red Hat Enterprise Linux 5 and 6.

--

This issue affects the versions of the pcsc-lite package, as shipped
with Fedora release of 13 and 14.

Please schedule an update with the above upstream patch.
Comment 2 Jan Lieskovsky 2010-12-22 07:36:57 EST
Created pcsc-lite tracking bugs for this issue

Affects: fedora-all [bug 665000]
Comment 3 Jan Lieskovsky 2010-12-22 07:57:38 EST
CVE Request:
http://www.openwall.com/lists/oss-security/2010/12/22/7
Comment 4 Kalev Lember 2011-01-05 06:35:28 EST
I have submitted updates for Fedora 13 and Fedora 14. In rawhide the version of the pcsc-lite package is newer, containing the upstream patch, and is not affected by the vulnerability.

https://admin.fedoraproject.org/updates/pcsc-lite-1.6.4-3.fc14
https://admin.fedoraproject.org/updates/pcsc-lite-1.5.5-5.fc13
Comment 9 Tomas Hoger 2013-01-02 10:01:00 EST
(In reply to comment #0)
> http://labs.mwrinfosecurity.com/files/Advisories/mwri_pcsc-atr-handler-
> buffer-overflow_2010-12-13.pdf

Now available via the following URL instead:

http://labs.mwrinfosecurity.com/assets/155/mwri_pcsc-atr-handler-buffer-overflow_2010-12-13.pdf
Comment 11 errata-xmlrpc 2013-02-21 06:00:16 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2013:0525 https://rhn.redhat.com/errata/RHSA-2013-0525.html
Comment 12 Huzaifa S. Sidhpurwala 2013-02-21 23:10:50 EST
Statement:

(none)

Note You need to log in before you can comment on or make changes to this bug.