The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3668 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3668-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     November 27, 2023                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : opensc     Version        : 0.19.0-1+deb10u3     CVE ID         : CVE-2023-40660 CVE-2023-40661     Debian Bug     : 1055521 1055522

    Vulnerabilities were found in opensc, a set of libraries and utilities     to access smart cards, which could lead to application crash or PIN     bypass.

    CVE-2023-40660

        When the token/card was plugged into the computer and authenticated         from one process, it could be used to provide cryptographic         operations from different process when the empty, zero-length PIN         and the token can track the login status using some of its         internals.  This is dangerous for OS logon/screen unlock and small         tokens that are plugged permanently to the computer.

        The bypass was removed and explicit logout implemented for most of         the card drivers to prevent leaving unattended logged-in tokens.

    CVE-2023-40661

        This advisory summarizes automatically reported issues from dynamic         analyzers reports in pkcs15-init that are security relevant.

          * stack buffer overflow in sc_pkcs15_get_lastupdate() in pkcs15init;
          * heap buffer overflow in setcos_create_key() in pkcs15init;
          * heap buffer overflow in cosm_new_file() in pkcs15init;
          * stack buffer overflow in cflex_delete_file() in pkcs15init;
          * heap buffer overflow in sc_hsm_write_ef() in pkcs15init;
          * stack buffer overflow while parsing pkcs15 profile files;
          * stack buffer overflow in muscle driver in pkcs15init; and
          * stack buffer overflow in cardos driver in pkcs15init.

        All of these require physical access to the computer at the time         user or administrator would be enrolling the cards (generating keys         and loading certificates, other card/token management) operations.
        The attack requires crafted USB device or smart card that would         present the system with specially crafted responses to the APDUs so         they are considered a high-complexity and low-severity.  This issue         is not exploitable just by using a PKCS#11 module as done in most of         the end-user deployments.

    For Debian 10 buster, these problems have been fixed in version     0.19.0-1+deb10u3.

    We recommend that you upgrade your opensc packages.

    For the detailed security status of opensc please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/opensc

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3668 : opensc - security update

medium Nessus Plugin ID 186290

Version 1.1

Version 1.0

Version 1.1 Jan 22, 2025, 5:44 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202501221744
Version 1.0 Nov 27, 2023, 10:14 AM New Plugin Feed: 202311271014