CVE-2008-2235

Name	CVE-2008-2235
Description	OpenSC before 0.11.5 uses weak permissions (ADMIN file control information of 00) for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proximate attackers to change the PIN.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-1627-2

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
opensc (PTS)	bullseye	0.21.0-1	fixed
	bullseye (security)	0.21.0-1+deb11u1	fixed
	bookworm	0.23.0-0.3+deb12u2	fixed
	sid, trixie	0.26.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
opensc	source	etch	0.11.1-2etch2		DSA-1627-2
opensc	source	(unstable)	0.11.4-4

https://web.archive.org/web/20081222095654/http://www.opensc-project.org/security.html