CVE Feed

    Dashboard / CVE / CVE-2010-4530

    CVE-2010-4530

    Signedness error in ccid_serial.c in libccid in the USB Chip/Smart Card Interface Devices (CCID) driver, as used in pcscd in PCSC-Lite 1.5.3 and possibly other products, allows physically proximate attackers to execute arbitrary code via a smart card with a crafted serial number that causes a negative value to be used in a memcpy operation, which triggers a buffer overflow. NOTE: some sources refer to this issue as an integer overflow.

    Published:Dec 13, 2010
    Last Modified:Apr 11, 2025
    EPS:Jan 18, 2011
    EPSS Score:0.00225
    CVSS Score:4.4

    Affected Products

    Vendor
    Muscle
    Product
    Pcsc-lite
    Vendor
    Redhat
    Product
    Enterprise Linux

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-190 Integer Overflow or Wraparound

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-92 Forced Integer Overflow

    References

    http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
    http://labs.mwrinfosecurity.com/files/Advisories/mwri_pcsc-libccid-buffer-overflow_2010-12-13.pdf
    http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053076.html
    http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053097.html
    http://rhn.redhat.com/errata/RHSA-2013-1323.html
    http://www.mandriva.com/security/advisories?name=MDVSA-2011:014
    http://www.openwall.com/lists/oss-security/2010/12/22/7
    http://www.openwall.com/lists/oss-security/2011/01/03/3
    http://www.securityfocus.com/bid/45806
    http://www.vupen.com/english/advisories/2011/0100
    http://www.vupen.com/english/advisories/2011/0179
    https://bugzilla.redhat.com/show_bug.cgi?id=664986
    https://exchange.xforce.ibmcloud.com/vulnerabilities/64961
    http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
    http://labs.mwrinfosecurity.com/files/Advisories/mwri_pcsc-libccid-buffer-overflow_2010-12-13.pdf
    http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053076.html
    http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053097.html
    http://rhn.redhat.com/errata/RHSA-2013-1323.html
    http://www.mandriva.com/security/advisories?name=MDVSA-2011:014
    http://www.openwall.com/lists/oss-security/2010/12/22/7
    http://www.openwall.com/lists/oss-security/2011/01/03/3
    http://www.securityfocus.com/bid/45806
    http://www.vupen.com/english/advisories/2011/0100
    http://www.vupen.com/english/advisories/2011/0179
    https://bugzilla.redhat.com/show_bug.cgi?id=664986
    https://exchange.xforce.ibmcloud.com/vulnerabilities/64961

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High