A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logon/screen unlock and for small, permanently connected tokens to computers. Additionally, the token can internally track login status. This flaw allows an attacker to gain unauthorized access, carry out malicious actions, or compromise the system without the user's awareness.

The remote host is affected by the vulnerability described in GLSA-202412-15 (OpenSC: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenSC. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the opensc-0.23.0-3.el9 build changelog.

  - Potential PIN bypass (CVE-2023-40660)

  - Dynamic analyzers reports in pkcs15init (CVE-2023-40661)

  - Out-of-bounds read in MyEID driver handling encryption using symmetric keys (CVE-2023-4535)

  - Side-channel leaks while stripping encryption PKCS#1.5 padding (CVE-2023-5992)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2023:7876 advisory.

  - A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated     by one process, it can perform cryptographic operations in other processes when an empty zero-length pin     is passed. This issue poses a security risk, particularly for OS logon/screen unlock and for small,     permanently connected tokens to computers. Additionally, the token can internally track login status. This     flaw allows an attacker to gain unauthorized access, carry out malicious actions, or compromise the system     without the user's awareness. (CVE-2023-40660)

  - Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card     enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of     these flaws, an attacker must have physical access to the computer system and employ a custom-crafted USB     device or smart card to manipulate responses to APDUs. This manipulation can potentially allow compromise     key generation, certificate loading, and other card management operations during enrollment.
    (CVE-2023-40661)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-c7e4c9af51 advisory.

    New upstream release (#2240701) with security fixes for CVE-2023-40660, CVE-2023-4535, CVE-2023-40661


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:7879 advisory.

  - A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated     by one process, it can perform cryptographic operations in other processes when an empty zero-length pin     is passed. This issue poses a security risk, particularly for OS logon/screen unlock and for small,     permanently connected tokens to computers. Additionally, the token can internally track login status. This     flaw allows an attacker to gain unauthorized access, carry out malicious actions, or compromise the system     without the user's awareness. (CVE-2023-40660)

  - Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card     enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of     these flaws, an attacker must have physical access to the computer system and employ a custom-crafted USB     device or smart card to manipulate responses to APDUs. This manipulation can potentially allow compromise     key generation, certificate loading, and other card management operations during enrollment.
    (CVE-2023-40661)

  - An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling     symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the     computer and a specially crafted USB device or smart card. This flaw allows the attacker to manipulate     APDU responses and potentially gain unauthorized access to sensitive data, compromising the system's     security. (CVE-2023-4535)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-a854153d7a advisory.

    New upstream release (#2240701) with security fixes for CVE-2023-40660, CVE-2023-4535, CVE-2023-40661


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:7876 advisory.

  - A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated     by one process, it can perform cryptographic operations in other processes when an empty zero-length pin     is passed. This issue poses a security risk, particularly for OS logon/screen unlock and for small,     permanently connected tokens to computers. Additionally, the token can internally track login status. This     flaw allows an attacker to gain unauthorized access, carry out malicious actions, or compromise the system     without the user's awareness. (CVE-2023-40660)

  - Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card     enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of     these flaws, an attacker must have physical access to the computer system and employ a custom-crafted USB     device or smart card to manipulate responses to APDUs. This manipulation can potentially allow compromise     key generation, certificate loading, and other card management operations during enrollment.
    (CVE-2023-40661)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-7876 advisory.

    - Fix CVE-2023-40660: Potential PIN bypass
    - Fix CVE-2023-40661: Dynamic analyzers reports in pkcs15init

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-7879 advisory.

    - Fix CVE-2023-40660: Potential PIN bypass
    - Fix CVE-2023-40661: Dynamic analyzers reports in pkcs15init
    - Fix CVE-2023-4535: Out-of-bounds read in MyEID driver handling encryption using symmetric keys

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:7879 advisory.

    The OpenSC set of libraries and utilities provides support for working with smart cards. OpenSC focuses on     cards that support cryptographic operations and enables their use for authentication, mail encryption, or     digital signatures.

    Security Fix(es):

    * OpenSC: Potential PIN bypass when card tracks its own login state (CVE-2023-40660)

    * OpenSC: multiple memory issues with pkcs15-init (enrollment tool) (CVE-2023-40661)

    * OpenSC: out-of-bounds read in MyEID driver handling encryption using symmetric keys (CVE-2023-4535)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:7876 advisory.

    The OpenSC set of libraries and utilities provides support for working with smart cards. OpenSC focuses on     cards that support cryptographic operations and enables their use for authentication, mail encryption, or     digital signatures.

    Security Fix(es):

    * OpenSC: Potential PIN bypass when card tracks its own login state (CVE-2023-40660)

    * OpenSC: multiple memory issues with pkcs15-init (enrollment tool) (CVE-2023-40661)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3668 advisory.

  - A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated     by one process, it can perform cryptographic operations in other processes when an empty zero-length pin     is passed. This issue poses a security risk, particularly for OS logon/screen unlock and for small,     permanently connected tokens to computers. Additionally, the token can internally track login status. This     flaw allows an attacker to gain unauthorized access, carry out malicious actions, or compromise the system     without the user's awareness. (CVE-2023-40660)

  - Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card     enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of     these flaws, an attacker must have physical access to the computer system and employ a custom-crafted USB     device or smart card to manipulate responses to APDUs. This manipulation can potentially allow compromise     key generation, certificate loading, and other card management operations during enrollment.
    (CVE-2023-40661)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-417 advisory.

    Potential PIN bypass.When the token/card was plugged into the computer and authenticated from one process,     it could be used to provide cryptographic operations from different process when the empty, zero-length     PIN and the token can track the login status using some of its internals. This is dangerous for OS     logon/screen unlock and small tokens that are plugged permanently to the computer. (CVE-2023-40660)

    multiple memory issues with pkcs15-init (enrollment tool) (CVE-2023-40661)

    Out-of-bounds read in MyEID driver handling encryption using symmetric keys

    This issue require physical access to the computer running opensc and crafted USB device or smart card     that would present the system with specially crafted responses to the APDUs so they are considered a high-     complexity and low-severity.

    This issue is in the code handling symmetric keys, which are not widely used for example for desktop login     so most of the deployments are not affected. (CVE-2023-4535)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of opensc installed on the remote host is prior to 0.19.0-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2323 advisory.

    Potential PIN bypass.When the token/card was plugged into the computer and authenticated from one process,     it could be used to provide cryptographic operations from different process when the empty, zero-length     PIN and the token can track the login status using some of its internals. This is dangerous for OS     logon/screen unlock and small tokens that are plugged permanently to the computer. (CVE-2023-40660)

    multiple memory issues with pkcs15-init (enrollment tool) (CVE-2023-40661)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4104-1 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4089-1 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
212334	GLSA-202412-15 : OpenSC: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
193934	CentOS 9 : opensc-0.23.0-3.el9	Nessus	CentOS Local Security Checks	medium
187739	CentOS 8 : opensc (CESA-2023:7876)	Nessus	CentOS Local Security Checks	medium
187278	Fedora 38 : opensc (2023-c7e4c9af51)	Nessus	Fedora Local Security Checks	medium
187215	AlmaLinux 9 : opensc (ALSA-2023:7879)	Nessus	Alma Linux Local Security Checks	medium
187189	Fedora 39 : opensc (2023-a854153d7a)	Nessus	Fedora Local Security Checks	medium
187128	AlmaLinux 8 : opensc (ALSA-2023:7876)	Nessus	Alma Linux Local Security Checks	medium
187095	Oracle Linux 8 : opensc (ELSA-2023-7876)	Nessus	Oracle Linux Local Security Checks	medium
187093	Oracle Linux 9 : opensc (ELSA-2023-7879)	Nessus	Oracle Linux Local Security Checks	medium
187087	RHEL 9 : opensc (RHSA-2023:7879)	Nessus	Red Hat Local Security Checks	medium
187086	RHEL 8 : opensc (RHSA-2023:7876)	Nessus	Red Hat Local Security Checks	medium
186290	Debian DLA-3668-1 : opensc - LTS security update	Nessus	Debian Local Security Checks	medium
184418	Amazon Linux 2023 : opensc (ALAS2023-2023-417)	Nessus	Amazon Linux Local Security Checks	medium
184292	Amazon Linux 2 : opensc (ALAS-2023-2323)	Nessus	Amazon Linux Local Security Checks	medium
183288	SUSE SLES15 Security Update : opensc (SUSE-SU-2023:4104-1)	Nessus	SuSE Local Security Checks	medium
183211	SUSE SLED15 / SLES15 Security Update : opensc (SUSE-SU-2023:4089-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2023-40660

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium