PCSC-Lite 'atrhandler.c' Buffer Overflow Vulnerability

Bugtraq ID:	45450
Class:	Boundary Condition Error
CVE:	CVE-2010-4531
Remote:	Yes
Local:	No
Published:	Nov 03 2010 12:00AM
Updated:	Apr 13 2015 09:41PM
Credit:	Rafael Dominguez Vega of MWR Info Security
Vulnerable:	Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 ARM Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 ARM Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 SuSE SUSE Linux Enterprise 11 SP1 SuSE SUSE Linux Enterprise 10 SP3 S.u.S.E. openSUSE 11.3 S.u.S.E. openSUSE 11.2 PCSC-Lite PCSC-Lite 1.5.3 Pardus Linux 2009 0 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 Mandriva Linux Mandrake 2010.0 x86_64 Mandriva Linux Mandrake 2010.0 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 CentOS CentOS 6 Avaya IP Office Server Edition 8.1 Avaya Aura Experience Portal 6.0.2 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 6.0.1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 6.0 SP2 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 6.0 SP1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 6.0 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700
Not Vulnerable:	PCSC-Lite PCSC-Lite 1.6.6

PCSC-Lite 'atrhandler.c' Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.


MandrakeSoft Enterprise Server 5 x86_64

• Mandriva lib64pcsclite-devel-1.4.102-1.2mdvmes5.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64pcsclite-static-devel-1.4.102-1.2mdvmes5.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64pcsclite1-1.4.102-1.2mdvmes5.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pcsc-lite-1.4.102-1.2mdvmes5.1.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Enterprise Server 5

• Mandriva libpcsclite-devel-1.4.102-1.2mdvmes5.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libpcsclite-static-devel-1.4.102-1.2mdvmes5.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libpcsclite1-1.4.102-1.2mdvmes5.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pcsc-lite-1.4.102-1.2mdvmes5.1.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2010.1 x86_64

• Mandriva lib64pcsclite-devel-1.5.5-2.1mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64pcsclite-static-devel-1.5.5-2.1mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64pcsclite1-1.5.5-2.1mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pcsc-lite-1.5.5-2.1mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2010.0

• Mandriva libpcsclite-devel-1.5.5-1.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libpcsclite-static-devel-1.5.5-1.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libpcsclite1-1.5.5-1.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pcsc-lite-1.5.5-1.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2010.0 x86_64

• Mandriva lib64pcsclite-devel-1.5.5-1.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64pcsclite-static-devel-1.5.5-1.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64pcsclite1-1.5.5-1.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pcsc-lite-1.5.5-1.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2010.1

• Mandriva libpcsclite-devel-1.5.5-2.1mdv2010.2.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libpcsclite-static-devel-1.5.5-2.1mdv2010.2.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libpcsclite1-1.5.5-2.1mdv2010.2.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pcsc-lite-1.5.5-2.1mdv2010.2.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2009.0

• Mandriva libpcsclite-devel-1.4.102-1.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libpcsclite-static-devel-1.4.102-1.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libpcsclite1-1.4.102-1.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pcsc-lite-1.4.102-1.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 4.0

• Mandriva libpcsclite1-1.3.0-2.2.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libpcsclite1-devel-1.3.0-2.2.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libpcsclite1-static-devel-1.3.0-2.2.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva pcsc-lite-1.3.0-2.2.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva lib64pcsclite-devel-1.4.102-1.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64pcsclite-static-devel-1.4.102-1.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64pcsclite1-1.4.102-1.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pcsc-lite-1.4.102-1.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 4.0 x86_64

• Mandriva lib64pcsclite1-1.3.0-2.2.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64pcsclite1-devel-1.3.0-2.2.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64pcsclite1-static-devel-1.3.0-2.2.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva pcsc-lite-1.3.0-2.2.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/

PCSC-Lite 'atrhandler.c' Buffer Overflow Vulnerability

References:

• PCSC-lite 1.6.6 Release Notes (PCSC-Lite)
  
• PCSC-Lite Homepage (PCSC-Lite)
  
• pcsc-lite security and bug fix update (RHSA-2013-0525) (Avaya)