CVE-2009-4901 Memory corruption in n/a

Low 2.1 Published 18 Jun 2010 Updated 7 Aug 2024

Local attackers can crash the PC/SC Smart Card daemon via crafted message data, causing a denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2009-4901?

CVE-2009-4901 is a low-severity memory corruption vulnerability in n/a, published on 18 Jun 2010. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The MSGFunctionDemarshall function in winscard_svc.c in the PC/SC Smart Card daemon (aka PCSCD) in MUSCLE PCSC-Lite before 1.5.4 might allow local users to cause a denial of service (daemon crash) via crafted SCARD_SET_ATTRIB message data, which is improperly demarshalled and triggers a buffer over-read, a related issue to CVE-2010-0407.

Weakness: CWE-119

Which versions are affected by CVE-2009-4901?

It affects 1 product.

Products include Muscle Pcsc-Lite.

How do I fix CVE-2009-4901?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2009-4901 being exploited?

There is no known exploitation of CVE-2009-4901 in the wild and no public exploit code.

Sources

Also known as GHSA-39fc-256h-c8gf.