CVE-2009-0368

NameCVE-2009-0368
DescriptionOpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements and read private data objects via a (1) low level APDU command or (2) debugging tool, as demonstrated by reading the 4601 or 4701 file with the opensc-explorer or opensc-tool program.
SourceCVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
ReferencesDSA-1734-1
NVD severitylow (attack range: local)
Debian/oldstablenot vulnerable.
Debian/stablenot vulnerable.
Debian/testingnot vulnerable.
Debian/unstablenot vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
opensc (PTS)squeeze0.11.13-1.1fixed
wheezy0.12.2-3fixed
jessie, sid0.14.0-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
openscsource(unstable)0.11.7-1low
openscsourceetch(not affected)
openscsourcelenny0.11.4-5+lenny1lowDSA-1734-1

Notes

[etch] - opensc <not-affected> (vulnerable code not present)

Search for package or bug name: Reporting problems