CVE-2009-1603 A minor update fixing security problem within pkcs11-tool command. http://www.opensc-project.org/pipermail/opensc- announce/2009-May/000025.html OpenSC is a package for for accessing smart card devices. Basic functionality (e.g. SELECT FILE, READ BINARY) should work on any ISO 7816-4 compatible smart card.
Encryption and decryption using private keys on the smart card is possible with PKCS #15 compatible cards, such as the FINEID (Finnish Electronic IDentity) card. Swedish Posten eID cards have also been confirmed to work. This is the MinGW cross-compiled Windows library.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

src/tools/pkcs11-tool.c in pkcs11-tool in OpenSC 0.11.7, when used with unspecified third-party PKCS#11 modules, generates RSA keys with incorrect public exponents, which allows attackers to read the cleartext form of messages that were intended to be encrypted (CVE-2009-1603).

The updated packages fix the issue.

A minor update fixing security problem within pkcs11-tool command.
http://www.opensc-project.org/pipermail/opensc-announce/2009-May/00002 5.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200908-01 (OpenSC: Multiple vulnerabilities)

    Multiple vulnerabilities were found in OpenSC:
    b.badrignans discovered that OpenSC incorrectly initialises private     data objects (CVE-2009-0368).
    Miquel Comas Marti discovered     that src/tools/pkcs11-tool.c in pkcs11-tool in OpenSC 0.11.7, when used     with unspecified third-party PKCS#11 modules, generates RSA keys with     incorrect public exponents (CVE-2009-1603).
  Impact :

    The first vulnerability allows physically proximate attackers to bypass     intended PIN requirements and read private data objects. The second     vulnerability allows attackers to read the cleartext form of messages     that were intended to be encrypted.
    NOTE: Smart cards which were initialised using an affected version of     OpenSC need to be modified or re-initialised. See the vendor's advisory     for details.
  Workaround :

    There is no known workaround at this time.

OpenSC 0.11.7 における pkcs11-tool での src/tools/pkcs11-tool.c は、詳細不明なサードパーティの PKCS#11 モジュールと共に使用される場合、不適切な公用指数で RSA キーを生成しています。これにより、攻撃者が、暗号化されることが意図されていたメッセージを平文の形式で読み取る可能性があります（CVE-2009-1603）。

更新済みパッケージは、この問題を修正します。

CVE-2009-1603 A minor update fixing security problem within pkcs11-tool command. http://www.opensc-project.org/pipermail/opensc- announce/2009-May/000025.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
38994	Fedora 11 : mingw32-opensc-0.11.8-1.fc11 (2009-4967)	Nessus	Fedora Local Security Checks	2009/6/3	2021/1/11	medium
48146	Mandriva Linux Security Advisory : opensc (MDVSA-2009:123)	Nessus	Mandriva Local Security Checks	2010/7/30	2021/1/6	medium
38958	Fedora 9 : opensc-0.11.8-1.fc9 (2009-4883)	Nessus	Fedora Local Security Checks	2009/6/1	2021/1/11	medium
40462	GLSA-200908-01 : OpenSC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2009/8/3	2021/1/6	medium
48146	Mandriva Linux セキュリティアドバイザリ：opensc（MDVSA-2009:123）	Nessus	Mandriva Local Security Checks	2010/7/30	2021/1/6	medium
38960	Fedora 10 : opensc-0.11.8-1.fc10 (2009-4919)	Nessus	Fedora Local Security Checks	2009/6/1	2021/1/11	medium
38993	Fedora 10 : mingw32-opensc-0.11.8-1.fc10 (2009-4928)	Nessus	Fedora Local Security Checks	2009/6/3	2021/1/11	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium