This host is installed with OpenSC and is prone to multiple buffer overflow vulnerabilities.

Successful exploitation could allow remote attackers to execute arbitrary code in the context of the application. Failed attacks will cause denial of service conditions. Impact Level: Application

Upgrade to OpenSC 0.12.0 or later. For updates refer to http://www.opensc-project.org/opensc

The flaws are due to boundary errors in the 'acos_get_serialnr()', 'acos5_get_serialnr()', and 'starcos_get_serialnr()' functions when reading out the serial number of smart cards.

OpenSC version 0.11.13 and prior.

• http://labs.mwrinfosecurity.com/files/Advisories/mwri_opensc-get-serial-buffer-overflow_2010-12-13.pdf
• http://secunia.com/advisories/42658
• https://www.opensc-project.org/opensc/changeset/4913

---

Updated on 2015-03-25