CVE-2009-0368

NameCVE-2009-0368
DescriptionOpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements and read private data objects via a (1) low level APDU command or (2) debugging tool, as demonstrated by reading the 4601 or 4701 file with the opensc-explorer or opensc-tool program.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-1734-1
NVD severitylow

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
opensc (PTS)stretch0.16.0-3+deb9u1fixed
buster0.19.0-1fixed
bullseye0.21.0-1fixed
bookworm, sid0.22.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
openscsourceetch(not affected)
openscsourcelenny0.11.4-5+lenny1DSA-1734-1
openscsource(unstable)0.11.7-1

Notes

[etch] - opensc <not-affected> (vulnerable code not present)

Search for package or bug name: Reporting problems