OpenSC 'pkcs11-tool' Insecure Key Generation Vulnerability
BID:34884
Info
OpenSC 'pkcs11-tool' Insecure Key Generation Vulnerability
| Bugtraq ID: | 34884 |
| Class: | Design Error |
| CVE: |
CVE-2009-1603 |
| Remote: | No |
| Local: | Yes |
| Published: | May 08 2009 12:00AM |
| Updated: | Apr 13 2015 10:06PM |
| Credit: | Reported by the vendor |
| Vulnerable: |
Pardus Linux 2008 0 OpenSC OpenSC 0.11.7 OpenSC OpenSC SVN trunk Mandriva Linux Mandrake 2009.1 x86_64 Mandriva Linux Mandrake 2009.1 Gentoo Linux |
| Not Vulnerable: |
OpenSC OpenSC 0.11.8 |
Discussion
OpenSC 'pkcs11-tool' Insecure Key Generation Vulnerability
OpenSC is prone to a security vulnerability that ma yallow users to generate insecure RSA public keys. This issue stems from a design error in the 'pkcs11-tool' module.
Attackers can exploit this issue to gain access to the private decryption key. Successfully exploits may allow attackers to obtain sensitive information or gain unauthorized access to the smartcard.
This issue affects only OpenSC 0.11.7 and the SVN trunk.
OpenSC is prone to a security vulnerability that ma yallow users to generate insecure RSA public keys. This issue stems from a design error in the 'pkcs11-tool' module.
Attackers can exploit this issue to gain access to the private decryption key. Successfully exploits may allow attackers to obtain sensitive information or gain unauthorized access to the smartcard.
This issue affects only OpenSC 0.11.7 and the SVN trunk.
Exploit / POC
OpenSC 'pkcs11-tool' Insecure Key Generation Vulnerability
To exploit this issue, an attacker must have physical access to the smartcard reader.
To exploit this issue, an attacker must have physical access to the smartcard reader.
Solution / Fix
OpenSC 'pkcs11-tool' Insecure Key Generation Vulnerability
Solution:
Updates are available. Please see the references for details.
Mandriva Linux Mandrake 2009.1
Mandriva Linux Mandrake 2009.1 x86_64
Solution:
Updates are available. Please see the references for details.
Mandriva Linux Mandrake 2009.1
-
Mandriva libopensc-devel-0.11.7-1.2mdv2009.1.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libopensc2-0.11.7-1.2mdv2009.1.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva mozilla-plugin-opensc-0.11.7-1.2mdv2009.1.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva opensc-0.11.7-1.2mdv2009.1.i586.rpm
http://www.mandriva.com/en/download/
Mandriva Linux Mandrake 2009.1 x86_64
-
Mandriva lib64opensc-devel-0.11.7-1.2mdv2009.1.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva lib64opensc2-0.11.7-1.2mdv2009.1.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva mozilla-plugin-opensc-0.11.7-1.2mdv2009.1.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva opensc-0.11.7-1.2mdv2009.1.x86_64.rpm
http://www.mandriva.com/en/download/
References
OpenSC 'pkcs11-tool' Insecure Key Generation Vulnerability
References:
References:
- OpenSC 0.11.8 released with security update (OpenSC)
- Vendor Homepage (OpenSC)