OpenSC up to 0.18.x esteid Card pkcs15-esteid.c sc_pkcs15emu_esteid_init memory corruption

Summaryinfo

A vulnerability labeled as critical has been found in OpenSC up to 0.18.x. Impacted is the function sc_pkcs15emu_esteid_init of the file libopensc/pkcs15-esteid.c of the component esteid Card Handler. The manipulation results in memory corruption. This vulnerability is identified as CVE-2018-16422. An attack on the physical device is feasible. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, was found in OpenSC up to 0.18.x. Affected is the function sc_pkcs15emu_esteid_init of the file libopensc/pkcs15-esteid.c of the component esteid Card Handler. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.

The bug was discovered 08/14/2018. The weakness was released 09/04/2018 (Website). The advisory is available at github.com. This vulnerability is traded as CVE-2018-16422 since 09/03/2018. The exploitability is told to be easy. Local access is required to approach this attack. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit.

The vulnerability was handled as a non-public zero-day exploit for at least 20 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 118880 (openSUSE Security Update : opensc (openSUSE-2018-1384)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family SuSE Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 171704 (SUSE Enterprise Linux Security Update for opensc (SUSE-SU-2018:3622-1)).

Upgrading to version 0.19.0-rc1 eliminates this vulnerability. A possible mitigation has been published 3 months after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (118880). Entries connected to this vulnerability are available at VDB-123526, VDB-123527, VDB-123528 and VDB-123542. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• OpenSC

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18

License

• open-source

Website

• Product: https://github.com/OpenSC/OpenSC/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion