CVE-2009-0368

OpenSC 0.11.x - PKCS#11 Implementation Unauthorized Access

Severity Score

2.1

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

OpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements and read private data objects via a (1) low level APDU command or (2) debugging tool, as demonstrated by reading the 4601 or 4701 file with the opensc-explorer or opensc-tool program.

Vulnerabilidad en OpenSC en versiones anteriores a v0.11.7 que permite a atacantes próximos físicamente evitar los requisitos de autenticación/validación de PIN a través de (1) el comando APDU de bajo nivel o (2) una herramienta de depuración de errores, como se ha demostrado leyendo el fichero 4601 o 4701 con el programa opensc-explorer o opensc-tool.

*Credits: N/A

CVSS Scores

NISTv2 2.1

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2009-01-29 CVE Reserved
2009-02-26 First Exploit
2009-03-02 CVE Published
2024-03-15 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-310: Cryptographic Issues

CAPEC

References (16)

URL	Tag	Source
http://secunia.com/advisories/34120	Third Party Advisory
http://secunia.com/advisories/34362	Third Party Advisory
http://secunia.com/advisories/34377	Third Party Advisory
http://secunia.com/advisories/35065	Third Party Advisory
http://secunia.com/advisories/36074	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/48958	Vdb Entry

URL	Date	SRC
https://www.exploit-db.com/exploits/32820	2009-02-26
http://www.securityfocus.com/bid/33922	2024-08-07

URL	Date	SRC
http://openwall.com/lists/oss-security/2009/02/26/1	2017-08-08

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html	2017-08-08
http://secunia.com/advisories/34052	2017-08-08
http://security.gentoo.org/glsa/glsa-200908-01.xml	2017-08-08
http://www.debian.org/security/2009/dsa-1734	2017-08-08
http://www.opensc-project.org/pipermail/opensc-announce/2009-February/000023.html	2017-08-08
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00673.html	2017-08-08
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00686.html	2017-08-08

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				<= 0.11.6 Search vendor "Opensc-project" for product "Opensc" and version " <= 0.11.6"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.3.2 Search vendor "Opensc-project" for product "Opensc" and version "0.3.2"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.3.5 Search vendor "Opensc-project" for product "Opensc" and version "0.3.5"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.4.0 Search vendor "Opensc-project" for product "Opensc" and version "0.4.0"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.5.0 Search vendor "Opensc-project" for product "Opensc" and version "0.5.0"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.6.0 Search vendor "Opensc-project" for product "Opensc" and version "0.6.0"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.6.1 Search vendor "Opensc-project" for product "Opensc" and version "0.6.1"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.7.0 Search vendor "Opensc-project" for product "Opensc" and version "0.7.0"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.8 Search vendor "Opensc-project" for product "Opensc" and version "0.8"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.8.0 Search vendor "Opensc-project" for product "Opensc" and version "0.8.0"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.8.0.0 Search vendor "Opensc-project" for product "Opensc" and version "0.8.0.0"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.8.1 Search vendor "Opensc-project" for product "Opensc" and version "0.8.1"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.9 Search vendor "Opensc-project" for product "Opensc" and version "0.9"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.9.2 Search vendor "Opensc-project" for product "Opensc" and version "0.9.2"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.9.3 Search vendor "Opensc-project" for product "Opensc" and version "0.9.3"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.9.4 Search vendor "Opensc-project" for product "Opensc" and version "0.9.4"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.9.5 Search vendor "Opensc-project" for product "Opensc" and version "0.9.5"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.9.6 Search vendor "Opensc-project" for product "Opensc" and version "0.9.6"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.9.7 Search vendor "Opensc-project" for product "Opensc" and version "0.9.7"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.9.7 Search vendor "Opensc-project" for product "Opensc" and version "0.9.7"		b		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.9.7 Search vendor "Opensc-project" for product "Opensc" and version "0.9.7"		d		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.9.8 Search vendor "Opensc-project" for product "Opensc" and version "0.9.8"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.10.0 Search vendor "Opensc-project" for product "Opensc" and version "0.10.0"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.10.1 Search vendor "Opensc-project" for product "Opensc" and version "0.10.1"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.11.0 Search vendor "Opensc-project" for product "Opensc" and version "0.11.0"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.11.1 Search vendor "Opensc-project" for product "Opensc" and version "0.11.1"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.11.2 Search vendor "Opensc-project" for product "Opensc" and version "0.11.2"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.11.3 Search vendor "Opensc-project" for product "Opensc" and version "0.11.3"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.11.3 Search vendor "Opensc-project" for product "Opensc" and version "0.11.3"		pre3		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.11.4 Search vendor "Opensc-project" for product "Opensc" and version "0.11.4"		-		Affected
Opensc-project Search vendor "Opensc-project"		Opensc Search vendor "Opensc-project" for product "Opensc"				0.11.5 Search vendor "Opensc-project" for product "Opensc" and version "0.11.5"		-		Affected