A buffer overflow issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `ykpiv_transfer_data()`: {% highlight c %} if(*out_len + recv_len - 2 > max_out) { fprintf(stderr, "Output buffer to small, wanted to write %lu, max was %lu.", *out_len + recv_len - 2, max_out); } if(out_data) { memcpy(out_data, data, recv_len - 2); out_data += recv_len - 2; *out_len += recv_len - 2; } {% endhighlight %} -- it is clearly checked whether the buffer is big enough to hold the data copied using `memcpy()`, but no error handling happens to avoid the `memcpy()` in such cases. This code path can be triggered with malicious data coming from a smartcard.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4846-1 advisory.

    It was discovered that libykpiv, a supporting library of the Yubico PIV tool and YubiKey PIV Manager,     mishandled specially crafted input. An attacker with a custom-made, malicious USB device could potentially     execute arbitrary code on a computer running the Yubico PIV Tool or Yubikey PIV Manager.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4276-1 advisory.

    It was discovered that libykpiv, a supporting library of the Yubico PIV Tool and YubiKey PIV Manager,     mishandled specially crafted input. An attacker with a custom-made, malicious USB device could potentially     execute arbitrary code on a computer running the Yubico PIV Tool or Yubikey PIV Manager.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for yubico-piv-tool fixes the following issues :

Security issues fixed :

  - Fixed an buffer overflow and an out of bounds memory     read in ykpiv_transfer_data(), which could be triggered     by a malicious token. (CVE-2018-14779, bsc#1104809,     YSA-2018-03)

  - Fixed an buffer overflow and an out of bounds memory     read in _ykpiv_fetch_object(), which could be triggered     by a malicious token. (CVE-2018-14780, bsc#1104811,     YSA-2018-03)

This update was imported from the SUSE:SLE-15:Update update project.

This update for yubico-piv-tool fixes the following issues :

Security issues fixed :

Fixed an buffer overflow and an out of bounds memory read in ykpiv_transfer_data(), which could be triggered by a malicious token.
(CVE-2018-14779, bsc#1104809, YSA-2018-03)

Fixed an buffer overflow and an out of bounds memory read in
_ykpiv_fetch_object(), which could be triggered by a malicious token.
(CVE-2018-14780, bsc#1104811, YSA-2018-03)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for yubico-piv-tool fixes the following issues :

Security issues fixed :

  - CVE-2018-14779: Fixed an buffer overflow and an out of     bounds memory read in ykpiv_transfer_data(), which could     be triggered by a malicious token. (boo#1104809,     YSA-2018-03)

  - CVE-2018-14780: Fixed an buffer overflow and an out of     bounds memory read in _ykpiv_fetch_object(), which could     be triggered by a malicious token. (boo#1104811,     YSA-2018-03)

ID	Name	Product	Family	Severity
183547	Ubuntu 16.04 ESM : Yubico PIV Tool vulnerabilities (USN-4846-1)	Nessus	Ubuntu Local Security Checks	medium
133648	Ubuntu 18.04 LTS : Yubico PIV Tool vulnerabilities (USN-4276-1)	Nessus	Ubuntu Local Security Checks	medium
124706	openSUSE Security Update : yubico-piv-tool (openSUSE-2019-1341)	Nessus	SuSE Local Security Checks	medium
124455	SUSE SLED15 / SLES15 Security Update : yubico-piv-tool (SUSE-SU-2019:1123-1)	Nessus	SuSE Local Security Checks	medium
117329	openSUSE Security Update : yubico-piv-tool (openSUSE-2018-969)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2018-14779

medium

Tenable Plugins

medium

medium

medium

medium

medium