CVE-2009-0368 Security feature bypass in n/a
Physically proximate attackers can bypass PIN requirements to read private data objects from smart cards using low-level commands or debugging tools.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-0368?
CVE-2009-0368 is a low-severity vulnerability in n/a, published on 2 Mar 2009. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
OpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements and read private data objects via a (1) low level APDU command or (2) debugging tool, as demonstrated by reading the 4601 or 4701 file with the opensc-explorer or opensc-tool program.
Weakness: CWE-310
Which versions are affected by CVE-2009-0368?
It affects 1 product.
Products include Opensc-Project Opensc.
How do I fix CVE-2009-0368?
Upgrade to a fixed version.
Is CVE-2009-0368 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-0368 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2009-0368, DSA-1734-1, GHSA-q2pp-hq8h-7mm3.