[ASA-202011-27] opensc: arbitrary code execution

[Morten Linderud]

Arch Linux Security Advisory ASA-202011-27
==========================================

Severity: Medium
Date    : 2020-11-26
CVE-ID  : CVE-2020-26570 CVE-2020-26571 CVE-2020-26572
Package : opensc
Type    : arbitrary code execution
Remote  : No
Link    : https://security.archlinux.org/AVG-1298

Summary
=======

The package opensc before version 0.21.0-1 is vulnerable to arbitrary
code execution.

Resolution
==========

Upgrade to 0.21.0-1.

# pacman -Syu "opensc>=0.21.0-1"

The problems have been fixed upstream in version 0.21.0.

Workaround
==========

None.

Description
===========

- CVE-2020-26570 (arbitrary code execution)

The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has
a heap-based buffer overflow in sc_oberthur_read_file.

- CVE-2020-26571 (arbitrary code execution)

The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1
has a stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init.

- CVE-2020-26572 (arbitrary code execution)

The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a
stack-based buffer overflow in tcos_decipher.

Impact
======

An attacker might be able to execute arbitrary code via crafted content
or metadata on a card.

References
==========

https://bugs.archlinux.org/task/68195
https://github.com/OpenSC/OpenSC/releases/tag/0.21.0
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24316
https://github.com/OpenSC/OpenSC/commit/6903aebfddc466d966c7b865fae34572bf3ed23e
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20612
https://github.com/OpenSC/OpenSC/commit/ed55fcd2996930bf58b9bb57e9ba7b1f3a753c43
https://github.com/OpenSC/OpenSC/commit/f49162af0476723a0f72ca66c9ce6dd5bf38807d
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22967
https://github.com/OpenSC/OpenSC/commit/9d294de90d1cc66956389856e60b6944b27b4817
https://security.archlinux.org/CVE-2020-26570
https://security.archlinux.org/CVE-2020-26571
https://security.archlinux.org/CVE-2020-26572
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20201205/aefe64fb/attachment.sig>