A vulnerability in CCID could result in execution of arbitrary code.

Announced

2014-01-21

Revised

2014-01-21

Access

local

Bugs

#349559

Advisory

https://security.gentoo.org/glsa/201401-16

Affected packages

Package	Arch	Vulnerable	Unaffected
app-crypt/ccid	*	< 1.4.1-r1	>= 1.4.1-r1

Background

CCID is a generic USB Chip/Smart Card Interface Devices driver.

Description

CCID contains an integer overflow vulnerability in ccid_serial.c.

Impact

A physically proximate attacker could execute arbitrary code via a smart card with a specially crafted serial number.

Workaround

There is no known workaround at this time.

Resolution

All CCID users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-crypt/ccid-1.4.1-r1"

NOTE: This is a legacy GLSA. Updates for all affected architectures are available since January 21, 2011. It is likely that your system is already no longer affected by this issue.

References

• CVE-2010-4530