libopensc in OpenSC is prone to an overflow condition. The 'acos_get_serialnr()', 'acos5_get_serialnr()' and 'starcos_get_serialnr()' functions fail to properly sanitize user-supplied input resulting in a stack-based buffer overflow. With a specially crafted smart card, a physically present attacker can potentially execute arbitrary code.

Currently, there are no known workarounds or upgrades to correct this issue. However, OpenSC has committed a source code patch to address this vulnerability.

• CVE ID: 2010-4523 (see also: NVD)
• Secunia Advisory ID: 42658 42807 43068
• VUPEN Advisory: ADV-2011-0009
• Vendor Specific News/Changelog Entry: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607427
  http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
  https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483
  https://bugzilla.redhat.com/show_bug.cgi?id=664831
  https://www.opensc-project.org/opensc/changeset/4913
• Other Advisory URL: http://labs.mwrinfosecurity.com/advisories/2010/12/13/opensc---get-serial-number-stack-based-buffer-overflow/
  http://labs.mwrinfosecurity.com/files/Advisories/mwri_opensc-get-serial-buffer-overflow_2010-12-13.pdf
  http://openwall.com/lists/oss-security/2010/12/21/2
  http://openwall.com/lists/oss-security/2010/12/22/3
  http://www.h-online.com/open/news/item/When-a-smart-card-can-root-your-computer-1154829.html
• Mail List Post: http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052777.html
  http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052796.html

• Rafael Dominguez Vega - MWR Labs/InfoSecurity