CVE-2010-4530 Integer overflow in n/a

Medium 4.4 Published 18 Jan 2011 Updated 7 Aug 2024

A signedness error in the libccid driver allows physically proximate attackers to execute arbitrary code via a crafted smart card serial number.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2010-4530?

CVE-2010-4530 is a medium-severity vulnerability in n/a, published on 18 Jan 2011. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Signedness error in ccid_serial.c in libccid in the USB Chip/Smart Card Interface Devices (CCID) driver, as used in pcscd in PCSC-Lite 1.5.3 and possibly other products, allows physically proximate attackers to execute arbitrary code via a smart card with a crafted serial number that causes a negative value to be used in a memcpy operation, which triggers a buffer overflow. NOTE: some sources refer to this issue as an integer overflow.

Weakness: CWE-189

Which versions are affected by CVE-2010-4530?

It affects 1 product.

Linux distribution packages (13)

`ccid` Red Hat:enterprise_linux:5::client	All versions	`0:1.3.8-2.el5`
`ccid-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`0:1.3.8-2.el5`
`ccid` Red Hat:enterprise_linux:5::server	All versions	`0:1.3.8-2.el5`
`ccid-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:1.3.8-2.el5`
`ccid` Red Hat:enterprise_linux:6::client	All versions	`0:1.3.9-6.el6`
`ccid-debuginfo` Red Hat:enterprise_linux:6::client	All versions	`0:1.3.9-6.el6`
`ccid` Red Hat:enterprise_linux:6::computenode	All versions	`0:1.3.9-6.el6`
`ccid-debuginfo` Red Hat:enterprise_linux:6::computenode	All versions	`0:1.3.9-6.el6`
`ccid` Red Hat:enterprise_linux:6::server	All versions	`0:1.3.9-6.el6`
`ccid-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`0:1.3.9-6.el6`
`ccid` Red Hat:enterprise_linux:6::workstation	All versions	`0:1.3.9-6.el6`
`ccid-debuginfo` Red Hat:enterprise_linux:6::workstation	All versions	`0:1.3.9-6.el6`
`pcsc-ccid` openSUSE:Tumbleweed	All versions	`1.4.25-1.1`

Products include Muscle Pcsc-Lite.

How do I fix CVE-2010-4530?

Apply the vendor's patch.

Is CVE-2010-4530 being exploited?

There is no known exploitation of CVE-2010-4530 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2010-4530, GHSA-9q64-c897-jp9x, RHSA-2013:0523, RHSA-2013:1323, openSUSE-SU-2024:10101-1.