[Security] pcsc-lite buffer overflows - CVE-2010-0407

[Brian Thomason]

pcsc-lite in Jaunty is vulnerable to buffer overflows in the Smart Card daemon which can allow local users to gain root privs.

[Jamie Strandboge (jdstrand)]

NAK for jaunty patch. It is not identical to 1.4.102-1+lenny3 (the latest version in Lenny that contains a regression fix).

Please resubmit using the fix in 1.4.102-1+lenny3, resubscribe ubuntu-security-sponsors and set the status to 'NEW' when the changes are complete. Thanks!

[Brian Thomason (brian-thomason)]

Good catch Jamie, thanks!

[Kees Cook (kees)]

Thanks for the patch! I've got this uploaded to the security queue now.

[Launchpad Janitor (janitor)]

This bug was fixed in the package pcsc-lite - 1.5.3-1ubuntu4.1

---------------
pcsc-lite (1.5.3-1ubuntu4.1) lucid-security; urgency=low

  * SECURITY UPDATE: fix buffer overflows (LP: #603657)
    - modified src/winscard_svc.c: Fix buffer overflows which allow local
      users to to gain privileges via crafted message data, which is
      improperly demarshalled. Patch provided by Debian in Lenny (DSA-2059-1)
      and Brian Thomason.
    - CVE-2010-0407
 -- Kees Cook <email address hidden> Tue, 27 Jul 2010 16:19:03 -0700

[Launchpad Janitor (janitor)]

This bug was fixed in the package pcsc-lite - 1.5.3-1ubuntu1.1

---------------
pcsc-lite (1.5.3-1ubuntu1.1) karmic-security; urgency=low

  * SECURITY UPDATE: fix buffer overflows (LP: #603657)
    - modified src/winscard_svc.c: Fix buffer overflows which allow local
      users to to gain privileges via crafted message data, which is
      improperly demarshalled. Patch provided by Debian in Lenny (DSA-2059-1)
      and Brian Thomason.
    - CVE-2010-0407
 -- Kees Cook <email address hidden> Tue, 27 Jul 2010 16:20:27 -0700

[Launchpad Janitor (janitor)]

This bug was fixed in the package pcsc-lite - 1.4.102-1ubuntu2.1

---------------
pcsc-lite (1.4.102-1ubuntu2.1) jaunty-security; urgency=low

  * SECURITY UPDATE: fix buffer overflows (LP: #603657)
  - modified src/winscard_svc.c: Fix buffer overflows which allow local users to
     to gain privileges via crafted message data, which is improperly
     demarshalled. Patch provided by Debian in Lenny. (DSA-2059-1)
  - CVE-2010-0407
 -- Brian Thomason <email address hidden> Fri, 09 Jul 2010 12:05:26 -0400

[Jamie Strandboge (jdstrand)]

Dapper universe is generally no longer actively supported (excepting server packages in main). If someone wants to create a patch and test it for Dapper, please attach and mark the Dapper task as Confiremed. Marking Won't Fix for now.

[Jamie Strandboge (jdstrand)]

Unsuscribing ubuntu-security-sponsors as there is no patch available for Hardy.

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug and helping to make Ubuntu better. The package referred to in this bug is in universe or multiverse and reported against a release of Ubuntu (hardy) which no longer receives updates outside of the explicitly supported LTS packages. While the bug against hardy is being marked "Won't Fix" for now, if you are interested feel free to post a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures'

Please feel free to report any other bugs you may find.