FKIE_CVE-2009-4901

Vulnerability from fkie_nvd - Published: 2010-06-18 16:30 - Updated: 2026-06-16 23:14
Severity
Summary
The MSGFunctionDemarshall function in winscard_svc.c in the PC/SC Smart Card daemon (aka PCSCD) in MUSCLE PCSC-Lite before 1.5.4 might allow local users to cause a denial of service (daemon crash) via crafted SCARD_SET_ATTRIB message data, which is improperly demarshalled and triggers a buffer over-read, a related issue to CVE-2010-0407.
References
cve@mitre.orghttp://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
cve@mitre.orghttp://lists.fedoraproject.org/pipermail/package-announce/2010-June/042900.html
cve@mitre.orghttp://lists.fedoraproject.org/pipermail/package-announce/2010-June/042921.html
cve@mitre.orghttp://secunia.com/advisories/40140Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/40239Vendor Advisory
cve@mitre.orghttp://svn.debian.org/wsvn/pcsclite/?sc=1&rev=4208
cve@mitre.orghttp://www.debian.org/security/2010/dsa-2059Patch
cve@mitre.orghttp://www.securityfocus.com/bid/40758Patch
cve@mitre.orghttp://www.vupen.com/english/advisories/2010/1427Vendor Advisory
cve@mitre.orghttp://www.vupen.com/english/advisories/2010/1508Vendor Advisory
cve@mitre.orghttps://bugzilla.redhat.com/show_bug.cgi?id=596426Patch
af854a3a-2127-422b-91ae-364da2661108http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
af854a3a-2127-422b-91ae-364da2661108http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042900.html
af854a3a-2127-422b-91ae-364da2661108http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042921.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/40140Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/40239Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://svn.debian.org/wsvn/pcsclite/?sc=1&rev=4208
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2010/dsa-2059Patch
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/40758Patch
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2010/1427Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2010/1508Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=596426Patch
Impacted products
Vendor Product Version
muscle pcsc-lite *
muscle pcsc-lite 1.1.2
muscle pcsc-lite 1.1.2
muscle pcsc-lite 1.1.2
muscle pcsc-lite 1.1.2
muscle pcsc-lite 1.2.0
muscle pcsc-lite 1.2.0
muscle pcsc-lite 1.2.0
muscle pcsc-lite 1.2.0
muscle pcsc-lite 1.2.9
muscle pcsc-lite 1.2.9
muscle pcsc-lite 1.2.9
muscle pcsc-lite 1.2.9
muscle pcsc-lite 1.2.9
muscle pcsc-lite 1.2.9
muscle pcsc-lite 1.2.9
muscle pcsc-lite 1.2.9
muscle pcsc-lite 1.2.9
muscle pcsc-lite 1.2.9
muscle pcsc-lite 1.3.0
muscle pcsc-lite 1.3.1
muscle pcsc-lite 1.3.2
muscle pcsc-lite 1.3.3
muscle pcsc-lite 1.4.0
muscle pcsc-lite 1.4.1
muscle pcsc-lite 1.4.2
muscle pcsc-lite 1.4.3
muscle pcsc-lite 1.4.4
muscle pcsc-lite 1.4.99
muscle pcsc-lite 1.4.100
muscle pcsc-lite 1.4.101
muscle pcsc-lite 1.4.102
muscle pcsc-lite 1.5.0
muscle pcsc-lite 1.5.1
muscle pcsc-lite 1.5.2
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "50F18AEC-160C-45E7-9554-0D39336DE4EA",
              "versionEndIncluding": "1.5.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.1.2:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "78E8EB5C-5E71-48A8-B09B-F2644F13A3A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.1.2:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "CAA8E0DE-C019-4633-A946-A7E175AD23B5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.1.2:beta4:*:*:*:*:*:*",
              "matchCriteriaId": "903F0D60-D275-47CB-93C2-EAE20466C2E8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.1.2:beta5:*:*:*:*:*:*",
              "matchCriteriaId": "B1004154-C058-448C-9C50-ABF2174FA262",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "46A00763-D902-402F-BC4B-2E47B08F50D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.2.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "65D08B7A-4318-4FB8-A149-258BAC8317C1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.2.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "DBCC7E79-FAAB-40C1-A963-45469DC2B8AD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.2.0:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "AC8CEF5A-8696-453C-8E0F-EA1F60DF6A11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.2.9:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "3595AD01-5244-4848-85CD-EDCE981ED122",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.2.9:beta10:*:*:*:*:*:*",
              "matchCriteriaId": "EC5FBA06-86F2-4154-A075-A91CFECA0077",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.2.9:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "2F0D22D4-4132-42B1-9582-F19F906F52A2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.2.9:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "C6A4D149-3DBF-4E0F-8BAB-4BD41EF92753",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.2.9:beta4:*:*:*:*:*:*",
              "matchCriteriaId": "9D74FC75-36ED-4F67-993D-75D75D84D0C2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.2.9:beta5:*:*:*:*:*:*",
              "matchCriteriaId": "C1D2AB67-7DA8-489C-A41E-5E44FCF47077",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.2.9:beta6:*:*:*:*:*:*",
              "matchCriteriaId": "BA18C77F-A0E4-454A-B457-CBA1596EC8EA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.2.9:beta7:*:*:*:*:*:*",
              "matchCriteriaId": "8EB00053-2D08-413E-A99C-2F280D4C09B0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.2.9:beta8:*:*:*:*:*:*",
              "matchCriteriaId": "05927DD0-FF2F-4C00-8343-E2A2C0444AC5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.2.9:beta9:*:*:*:*:*:*",
              "matchCriteriaId": "9C8EAAEE-6DA1-4BFA-B2CE-DE7326A16901",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "EA5FBECF-7A1A-4A85-ACDB-BAFA1CBB2FB0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "77E63206-188B-411A-B922-EBF1156DF8B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "5CAD5268-CC5F-4A02-BDFF-781ED5F09862",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "7B607020-8BE6-42DE-808C-D39EDF9865CB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "3F3DDB2F-0287-45AF-8D1E-50A0FBAE933A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "710CCA42-8525-4498-BA91-0B13DA7880AF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.4.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "3A3FDF41-D5DF-4C46-9925-C0A2967BD2BC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.4.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "A5F8E2F7-6EF7-4628-B519-A475B3B0D452",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.4.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "63B0D255-1770-4B31-B20D-D1AC28AF0ADA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.4.99:*:*:*:*:*:*:*",
              "matchCriteriaId": "D7F2625B-142D-48C1-A81A-3F4F4E5753DA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.4.100:*:*:*:*:*:*:*",
              "matchCriteriaId": "55E8A018-D713-4A15-BDC3-F86BC3BDD5CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.4.101:*:*:*:*:*:*:*",
              "matchCriteriaId": "3ECC79CA-5489-49A9-8A4E-303693882E60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.4.102:*:*:*:*:*:*:*",
              "matchCriteriaId": "0E006C9C-49FB-465D-9C03-25AEBAAAA40E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD3C9309-E91A-4F9B-BFEE-DD273CB8C6B0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2E53908-A49C-4E31-9BCE-4FD5DB78BD8F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:muscle:pcsc-lite:1.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "CFCDCD9B-27A4-4591-93AA-38A60382FF41",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The MSGFunctionDemarshall function in winscard_svc.c in the PC/SC Smart Card daemon (aka PCSCD) in MUSCLE PCSC-Lite before 1.5.4 might allow local users to cause a denial of service (daemon crash) via crafted SCARD_SET_ATTRIB message data, which is improperly demarshalled and triggers a buffer over-read, a related issue to CVE-2010-0407."
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n MSGFunctionDemarshall en winscard_svc.c en el demonio PC/SC Smart Card (tambi\u00e9n conocido como PCSCD) en MUSCLE PCSC-Lite anteriores a v1.5.4 podr\u00eda permitir a usuarios localesprovocar una denegaci\u00f3n de servicio (ca\u00edda del demonio) a trav\u00e9s de una mensaje de datos SCARD_SET_ATTRIB manipulado, el cual es deserializado de forma inadecuada provoca una sobrelectura del b\u00fafer, es diferente a CVE-2010-0407."
    }
  ],
  "id": "CVE-2009-4901",
  "lastModified": "2026-06-16T23:14:34.270",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 2.1,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2010-06-18T16:30:01.233",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10705"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042900.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042921.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/40140"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/40239"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://svn.debian.org/wsvn/pcsclite/?sc=1\u0026rev=4208"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.debian.org/security/2010/dsa-2059"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/40758"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2010/1427"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2010/1508"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=596426"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10705"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042900.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042921.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/40140"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/40239"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://svn.debian.org/wsvn/pcsclite/?sc=1\u0026rev=4208"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.debian.org/security/2010/dsa-2059"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/40758"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2010/1427"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2010/1508"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=596426"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.