Debian: DSA-1734-1: New opensc packages fix information disclosure

    Date05 Mar 2009
    CategoryDebian
    34
    Posted ByLinuxSecurity Advisories
    b.badrignans discovered that OpenSC, a set of smart card utilities, could stores private data on a smart card without proper access restrictions.
    
    - ------------------------------------------------------------------------
    Debian Security Advisory DSA-1734-1                  This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://www.debian.org/security/                          Thijs Kinkhorst
    March 05, 2009                        http://www.debian.org/security/faq
    - ------------------------------------------------------------------------
    
    Package        : opensc
    Vulnerability  : programming error
    Problem type   : local
    Debian-specific: no
    CVE Id(s)      : CVE-2009-0368
    
    b.badrignans discovered that OpenSC, a set of smart card utilities,
    could stores private data on a smart card without proper access
    restrictions.
    
    Only blank cards initialised with OpenSC are affected by this problem.
    This update only improves creating new private data objects, but cards
    already initialised with such private data objects need to be
    modified to repair the access control conditions on such cards.
    Instructions for a variety of situations can be found at the OpenSC
    web site: http://www.opensc-project.org/security.html
    
    The oldstable distribution (etch) is not affected by this problem.
    
    For the stable distribution (lenny), this problem has been fixed in
    version 0.11.4-5+lenny1.
    
    For the unstable distribution (sid), this problem wil be fixed soon.
    
    We recommend that you upgrade your opensc package and recreate any
    private data objects stored on your smart cards.
    
    Upgrade instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 5.0 alias lenny
    - --------------------------------
    
    Source archives:
    
      http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4-5+lenny1.dsc
        Size/MD5 checksum:     1333 a6a3c786d70bba230912db8550321b74
      http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4-5+lenny1.diff.gz
        Size/MD5 checksum:    59733 5c19aa261ca11caeb9b46defe3a31754
      http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4.orig.tar.gz
        Size/MD5 checksum:  1410650 2031aa617be609d50d014d5d370bb8a2
    
    alpha architecture (DEC Alpha)
    
      http://security.debian.org/pool/updates/main/o/opensc/mozilla-opensc_0.11.4-5+lenny1_alpha.deb
        Size/MD5 checksum:   172210 4c13e02bdae7b31e03c07c77114ba7c5
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dev_0.11.4-5+lenny1_alpha.deb
        Size/MD5 checksum:  1425142 7de474eeba7f7c4d7c4ea720ce35a113
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2_0.11.4-5+lenny1_alpha.deb
        Size/MD5 checksum:   617062 71bb9f5faf9dec5fb628f60d72a1f32c
      http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4-5+lenny1_alpha.deb
        Size/MD5 checksum:   395886 5f611a12bb340abcecd753ce9a0a9f7d
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dbg_0.11.4-5+lenny1_alpha.deb
        Size/MD5 checksum:  1244884 e4fd99a2cdd5822eeb3c27200bdeabf4
    
    amd64 architecture (AMD x86_64 (AMD64))
    
      http://security.debian.org/pool/updates/main/o/opensc/mozilla-opensc_0.11.4-5+lenny1_amd64.deb
        Size/MD5 checksum:   170424 797bf32516f3c8bf2784a40b3ea4b69b
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2_0.11.4-5+lenny1_amd64.deb
        Size/MD5 checksum:   600140 b426f75de39097f951edbb6beb267faf
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dev_0.11.4-5+lenny1_amd64.deb
        Size/MD5 checksum:  1220570 9fac7d931102a13759ff27ca3e63886f
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dbg_0.11.4-5+lenny1_amd64.deb
        Size/MD5 checksum:  1250976 348819662c1e6d0f856468f57f963bef
      http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4-5+lenny1_amd64.deb
        Size/MD5 checksum:   385876 e82572802a8f5297d4b231510d66a703
    
    arm architecture (ARM)
    
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2_0.11.4-5+lenny1_arm.deb
        Size/MD5 checksum:   553454 d2f2216d33649da2dedd0695f15df2bf
      http://security.debian.org/pool/updates/main/o/opensc/mozilla-opensc_0.11.4-5+lenny1_arm.deb
        Size/MD5 checksum:   164808 0a97588a633ef6fd02a7d8b7c42f75c9
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dbg_0.11.4-5+lenny1_arm.deb
        Size/MD5 checksum:  1192088 36f02f0adf21ff6681cb0fc82ed70bd0
      http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4-5+lenny1_arm.deb
        Size/MD5 checksum:   373220 4d994a576b5727bdd255977d0618ad4f
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dev_0.11.4-5+lenny1_arm.deb
        Size/MD5 checksum:  1082568 27a17ba27333f92ec57c4610c9332eb2
    
    armel architecture (ARM EABI)
    
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dbg_0.11.4-5+lenny1_armel.deb
        Size/MD5 checksum:  1194564 4be8b8833593141ec3e001165687a157
      http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4-5+lenny1_armel.deb
        Size/MD5 checksum:   369484 b8de7da5f2f0b6d54db89f9e3a19d160
      http://security.debian.org/pool/updates/main/o/opensc/mozilla-opensc_0.11.4-5+lenny1_armel.deb
        Size/MD5 checksum:   165046 9653c45b02a720ccdbb34856fd3a76b1
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2_0.11.4-5+lenny1_armel.deb
        Size/MD5 checksum:   554712 b2773b917fa2e0bc309fd458c0fea985
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dev_0.11.4-5+lenny1_armel.deb
        Size/MD5 checksum:  1090686 475492b51137ee7a91601c179b077bf4
    
    i386 architecture (Intel ia32)
    
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dev_0.11.4-5+lenny1_i386.deb
        Size/MD5 checksum:  1088224 11cb33b66522a8f90a4dffbb1c759cbe
      http://security.debian.org/pool/updates/main/o/opensc/mozilla-opensc_0.11.4-5+lenny1_i386.deb
        Size/MD5 checksum:   168202 46bb9b184aee6a8b8a8b585339baf872
      http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4-5+lenny1_i386.deb
        Size/MD5 checksum:   370748 1b61f2a6158c92d54209de0846604ed2
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dbg_0.11.4-5+lenny1_i386.deb
        Size/MD5 checksum:  1193874 8901246b5fd2aefd2160fd173090f19b
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2_0.11.4-5+lenny1_i386.deb
        Size/MD5 checksum:   552886 46c25a7402174e76930ffeb6f398f040
    
    ia64 architecture (Intel ia64)
    
      http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4-5+lenny1_ia64.deb
        Size/MD5 checksum:   450212 553319b58affb12649c97fd1d37e8f8e
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dbg_0.11.4-5+lenny1_ia64.deb
        Size/MD5 checksum:  1191394 17eb91686da2e1981c2915a6bd5bc584
      http://security.debian.org/pool/updates/main/o/opensc/mozilla-opensc_0.11.4-5+lenny1_ia64.deb
        Size/MD5 checksum:   181174 837b37ae471abef686d1e4bbcae8e23d
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2_0.11.4-5+lenny1_ia64.deb
        Size/MD5 checksum:   764982 0da3fd6cbf96bd50c4be097b7db65648
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dev_0.11.4-5+lenny1_ia64.deb
        Size/MD5 checksum:  1468110 ad9ce50c292f3e7ece834e698906044c
    
    mips architecture (MIPS (Big Endian))
    
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2_0.11.4-5+lenny1_mips.deb
        Size/MD5 checksum:   552488 ec12157337de83c661021aee7125db85
      http://security.debian.org/pool/updates/main/o/opensc/mozilla-opensc_0.11.4-5+lenny1_mips.deb
        Size/MD5 checksum:   166188 1eb9628b793ef050d1236cc9e4d4d532
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dev_0.11.4-5+lenny1_mips.deb
        Size/MD5 checksum:  1264080 684081bb05cb738cdf3e4b70b050565a
      http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4-5+lenny1_mips.deb
        Size/MD5 checksum:   377328 4968819d61a98db60aeb9bd5f07f49b1
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dbg_0.11.4-5+lenny1_mips.deb
        Size/MD5 checksum:  1254718 156a199d51fe78218b4538449b1d3900
    
    mipsel architecture (MIPS (Little Endian))
    
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2_0.11.4-5+lenny1_mipsel.deb
        Size/MD5 checksum:   550368 3aa883498240d28dc669804f28fe80a9
      http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4-5+lenny1_mipsel.deb
        Size/MD5 checksum:   377668 cb0740488998e4f703c015260f209f85
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dbg_0.11.4-5+lenny1_mipsel.deb
        Size/MD5 checksum:  1235814 c61ddb25efc7625fece5c1f726ad5ed6
      http://security.debian.org/pool/updates/main/o/opensc/mozilla-opensc_0.11.4-5+lenny1_mipsel.deb
        Size/MD5 checksum:   166032 f673d0d05f0acc00ef26ddab2b3ae018
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dev_0.11.4-5+lenny1_mipsel.deb
        Size/MD5 checksum:  1247014 01e37c41e5aff2e4e41a5a76cab2d746
    
    powerpc architecture (PowerPC)
    
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dev_0.11.4-5+lenny1_powerpc.deb
        Size/MD5 checksum:  1281994 f6ff6e01ea9a89ff80dfa3988972a716
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dbg_0.11.4-5+lenny1_powerpc.deb
        Size/MD5 checksum:  1253656 53557381f96bfce43e16d4652e9d445b
      http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4-5+lenny1_powerpc.deb
        Size/MD5 checksum:   408656 d56d8d461f12cd491d373262eb1e6c07
      http://security.debian.org/pool/updates/main/o/opensc/mozilla-opensc_0.11.4-5+lenny1_powerpc.deb
        Size/MD5 checksum:   171890 b5407ebd8e0b7b834ced0d23dc9060e8
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2_0.11.4-5+lenny1_powerpc.deb
        Size/MD5 checksum:   597100 c73b0856c446c730cb4b7a7f9c51b3eb
    
    s390 architecture (IBM S/390)
    
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2_0.11.4-5+lenny1_s390.deb
        Size/MD5 checksum:   594044 061ccf2f3690bae30a1493a9b1b54fcf
      http://security.debian.org/pool/updates/main/o/opensc/mozilla-opensc_0.11.4-5+lenny1_s390.deb
        Size/MD5 checksum:   171064 de877a46c93397604a33439eeb4da6c1
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dbg_0.11.4-5+lenny1_s390.deb
        Size/MD5 checksum:  1242074 42f645018b540f551573815813e2b014
      http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dev_0.11.4-5+lenny1_s390.deb
        Size/MD5 checksum:  1288032 57133c53afe7b50f517577fb3223ec80
      http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4-5+lenny1_s390.deb
        Size/MD5 checksum:   382574 7939fd08de0421d15f5c7a20ff935576
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    Package info: `apt-cache show ' and http://packages.debian.org/
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    Do you read our distribution advisories on a regular basis?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /component/communitypolls/?task=poll.vote&format=json
    23
    radio
    [{"id":"84","title":"Yes, for a single distribution","votes":"0","type":"x","order":"1","pct":0,"resources":[]},{"id":"85","title":"Yes, for multiple distributions","votes":"6","type":"x","order":"2","pct":60,"resources":[]},{"id":"86","title":"No","votes":"4","type":"x","order":"3","pct":40,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.