src/tools/pkcs11-tool.c in pkcs11-tool in OpenSC 0.11.7, when used with unspecified third-party PKCS#11 modules, generates RSA keys with incorrect public exponents, which allows attackers to read the cleartext form of messages that were intended to be encrypted.

src/tools/pkcs11-tool.c in pkcs11-tool in OpenSC 0.11.7, when used with unspecified third-party PKCS#11 modules, generates RSA keys with incorrect public exponents, which allows attackers to read the cleartext form of messages that were intended to be encrypted (CVE-2009-1603).

The updated packages fix the issue.

The remote host is affected by the vulnerability described in GLSA-200908-01 (OpenSC: Multiple vulnerabilities)

    Multiple vulnerabilities were found in OpenSC:
    b.badrignans discovered that OpenSC incorrectly initialises private     data objects (CVE-2009-0368).
    Miquel Comas Marti discovered     that src/tools/pkcs11-tool.c in pkcs11-tool in OpenSC 0.11.7, when used     with unspecified third-party PKCS#11 modules, generates RSA keys with     incorrect public exponents (CVE-2009-1603).
  Impact :

    The first vulnerability allows physically proximate attackers to bypass     intended PIN requirements and read private data objects. The second     vulnerability allows attackers to read the cleartext form of messages     that were intended to be encrypted.
    NOTE: Smart cards which were initialised using an affected version of     OpenSC need to be modified or re-initialised. See the vendor's advisory     for details.
  Workaround :

    There is no known workaround at this time.

CVE-2009-1603 A minor update fixing security problem within pkcs11-tool command. http://www.opensc-project.org/pipermail/opensc- announce/2009-May/000025.html OpenSC is a package for for accessing smart card devices. Basic functionality (e.g. SELECT FILE, READ BINARY) should work on any ISO 7816-4 compatible smart card.
Encryption and decryption using private keys on the smart card is possible with PKCS #15 compatible cards, such as the FINEID (Finnish Electronic IDentity) card. Swedish Posten eID cards have also been confirmed to work. This is the MinGW cross-compiled Windows library.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2009-1603 A minor update fixing security problem within pkcs11-tool command. http://www.opensc-project.org/pipermail/opensc- announce/2009-May/000025.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A minor update fixing security problem within pkcs11-tool command.
http://www.opensc-project.org/pipermail/opensc-announce/2009-May/00002 5.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
48146	Mandriva Linux Security Advisory : opensc (MDVSA-2009:123)	Nessus	Mandriva Local Security Checks	medium
40462	GLSA-200908-01 : OpenSC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
38994	Fedora 11 : mingw32-opensc-0.11.8-1.fc11 (2009-4967)	Nessus	Fedora Local Security Checks	medium
38993	Fedora 10 : mingw32-opensc-0.11.8-1.fc10 (2009-4928)	Nessus	Fedora Local Security Checks	medium
38960	Fedora 10 : opensc-0.11.8-1.fc10 (2009-4919)	Nessus	Fedora Local Security Checks	medium
38958	Fedora 9 : opensc-0.11.8-1.fc9 (2009-4883)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2009-1603

high

Tenable Plugins

medium

medium

medium

medium

medium

medium