CVE Vulnerability

CVE-2008-3972

pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart card unless the card's label matches the "OpenSC" string, which might allow physically proximate attackers to exploit vulnerabilities that the card owner expected were patched, as demonstrated by exploitation of CVE-2008-2235.

6.6 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 9.2

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact COMPLETE

Availability Impact COMPLETE

Scope

References
Link Resource
http://www.openwall.com/lists/oss-security/2008/09/09/14
http://www.opensc-project.org/pipermail/opensc-announce/2008-August/000021.html
http://secunia.com/advisories/32099
http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00005.html
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00686.html
http://secunia.com/advisories/34362
https://exchange.xforce.ibmcloud.com/vulnerabilities/45045
Configurations

Configuration 1
Information

Published : 2008-09-11 01:13

Updated : 2017-08-08 01:32

NVD link : CVE-2008-3972

Mitre link : CVE-2008-3972

Products Affected
No products.
CWE
CWE-264