Bug 664999 (CVE-2010-4531) - CVE-2010-4531 pcsc-lite: Stack-based buffer overflow in Answer-to-Reset (ATR) decoder
Summary: CVE-2010-4531 pcsc-lite: Stack-based buffer overflow in Answer-to-Reset (ATR)...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2010-4531
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 665000 883651
Blocks: 855229
TreeView+ depends on / blocked
 
Reported: 2010-12-22 12:34 UTC by Jan Lieskovsky
Modified: 2019-09-29 12:42 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-03-31 10:06:01 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2013:0525 normal SHIPPED_LIVE Moderate: pcsc-lite security and bug fix update 2013-02-20 21:28:34 UTC

Description Jan Lieskovsky 2010-12-22 12:34:01 UTC
A stack-based buffer overflow flaw was found in the way
PC/SC Lite smart card framework decoded certain attribute 
values of the Answer-to-Reset (ATR) message, received back
from the card after connecting. A local attacker could
use this flaw to execute arbitrary code with the privileges
of the user running the pcscd daemon, via a malicious smart
card inserted to the system USB port.

References:
[1] http://labs.mwrinfosecurity.com/files/Advisories/mwri_pcsc-atr-handler-buffer-overflow_2010-12-13.pdf
[2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607781
[3] http://www.vupen.com/english/advisories/2010/3264

Upstream changeset:
[4] http://lists.alioth.debian.org/pipermail/pcsclite-cvs-commit/2010-November/004923.html

Comment 1 Jan Lieskovsky 2010-12-22 12:35:54 UTC
This issue affects the versions of the pcsc-lite package, as shipped
with Red Hat Enterprise Linux 5 and 6.

--

This issue affects the versions of the pcsc-lite package, as shipped
with Fedora release of 13 and 14.

Please schedule an update with the above upstream patch.

Comment 2 Jan Lieskovsky 2010-12-22 12:36:57 UTC
Created pcsc-lite tracking bugs for this issue

Affects: fedora-all [bug 665000]

Comment 3 Jan Lieskovsky 2010-12-22 12:57:38 UTC
CVE Request:
http://www.openwall.com/lists/oss-security/2010/12/22/7

Comment 4 Kalev Lember 2011-01-05 11:35:28 UTC
I have submitted updates for Fedora 13 and Fedora 14. In rawhide the version of the pcsc-lite package is newer, containing the upstream patch, and is not affected by the vulnerability.

https://admin.fedoraproject.org/updates/pcsc-lite-1.6.4-3.fc14
https://admin.fedoraproject.org/updates/pcsc-lite-1.5.5-5.fc13

Comment 9 Tomas Hoger 2013-01-02 15:01:00 UTC
(In reply to comment #0)
> http://labs.mwrinfosecurity.com/files/Advisories/mwri_pcsc-atr-handler-
> buffer-overflow_2010-12-13.pdf

Now available via the following URL instead:

http://labs.mwrinfosecurity.com/assets/155/mwri_pcsc-atr-handler-buffer-overflow_2010-12-13.pdf

Comment 11 errata-xmlrpc 2013-02-21 11:00:16 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2013:0525 https://rhn.redhat.com/errata/RHSA-2013-0525.html

Comment 12 Huzaifa S. Sidhpurwala 2013-02-22 04:10:50 UTC
Statement:

(none)


Note You need to log in before you can comment on or make changes to this bug.