oss-security - Re: opensc 0.11.6 with fixed security update

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Tue, 9 Sep 2008 10:49:02 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: Ludwig Nussel <ludwig.nussel@...e.de>
cc: oss-security@...ts.openwall.com, cve@...re.org
Subject: Re: opensc 0.11.6 with fixed security update

Details on the "glitch" from
http://www.opensc-project.org/pipermail/opensc-announce/2008-August/000021.html
:

OpenSC 0.11.5 released July 30th 2008 was found to contain only a partial
fix.  The new tool for testing and updating smart cards ("pkcs15-tool -T")
contained a too strict check - including the Card label to match "OpenSC".
Jean-Pierre Szikora found this problem: a card can be initialized with
setting any label (use "pkcs15-init --create-pkcs15 --label foobar" for
example), thus this check was too strict and had to be removed.

With this bug anyone can change a user PIN without having the PIN or PUK
or the superusers PIN or PUK. However it can not be used to figure out the
PIN.  Thus if the PIN on your card is still the same you always had, then
you can be sure, that noone exploited this vulnerability.

Use CVE-2008-3972

- Steve

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.