The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:7879 advisory.

  - A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated     by one process, it can perform cryptographic operations in other processes when an empty zero-length pin     is passed. This issue poses a security risk, particularly for OS logon/screen unlock and for small,     permanently connected tokens to computers. Additionally, the token can internally track login status. This     flaw allows an attacker to gain unauthorized access, carry out malicious actions, or compromise the system     without the user's awareness. (CVE-2023-40660)

  - Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card     enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of     these flaws, an attacker must have physical access to the computer system and employ a custom-crafted USB     device or smart card to manipulate responses to APDUs. This manipulation can potentially allow compromise     key generation, certificate loading, and other card management operations during enrollment.
    (CVE-2023-40661)

  - An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling     symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the     computer and a specially crafted USB device or smart card. This flaw allows the attacker to manipulate     APDU responses and potentially gain unauthorized access to sensitive data, compromising the system's     security. (CVE-2023-4535)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

AlmaLinux 9 : opensc (ALSA-2023:7879)

medium Nessus Plugin ID 187215

Version 1.0