Vulnerability-Lookup

usn-4276-1

Vulnerability from osv_ubuntu

Published

2020-02-11 14:52

Modified

2026-04-22 07:36

Summary

Yubico PIV Tool vulnerabilities

Details

It was discovered that libykpiv, a supporting library of the Yubico PIV Tool and YubiKey PIV Manager, mishandled specially crafted input. An attacker with a custom-made, malicious USB device could potentially execute arbitrary code on a computer running the Yubico PIV Tool or Yubikey PIV Manager.

References

URL

Type

	https://ubuntu.com/security/notices/USN-4276-1	ADVISORY
	https://ubuntu.com/security/CVE-2018-14779	REPORT
	https://ubuntu.com/security/CVE-2018-14780	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2018-14779",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-14780",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:18.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libykpiv1",
            "binary_version": "1.4.2-2ubuntu0.1"
          },
          {
            "binary_name": "ykcs11",
            "binary_version": "1.4.2-2ubuntu0.1"
          },
          {
            "binary_name": "yubico-piv-tool",
            "binary_version": "1.4.2-2ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "yubico-piv-tool",
        "purl": "pkg:deb/ubuntu/yubico-piv-tool@1.4.2-2ubuntu0.1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.2-2ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.2-2"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that libykpiv, a supporting library of the Yubico PIV\nTool and YubiKey PIV Manager, mishandled specially crafted input. An\nattacker with a custom-made, malicious USB device could potentially execute\narbitrary code on a computer running the Yubico PIV Tool or Yubikey PIV\nManager.\n",
  "id": "USN-4276-1",
  "modified": "2026-04-22T07:36:38Z",
  "published": "2020-02-11T14:52:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-4276-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-14779"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-14780"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "Yubico PIV Tool vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2018-14779",
    "UBUNTU-CVE-2018-14780"
  ]
}

ubuntu-cve-2018-14779

Vulnerability from osv_ubuntu

Published

2018-08-15 18:29

Modified

2026-04-22 07:38

Summary

Details

A buffer overflow issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function ykpiv_transfer_data(): {% highlight c %} if(out_len + recv_len - 2 > max_out) { fprintf(stderr, "Output buffer to small, wanted to write %lu, max was %lu.", out_len + recv_len - 2, max_out); } if(out_data) { memcpy(out_data, data, recv_len - 2); out_data += recv_len - 2; *out_len += recv_len - 2; } {% endhighlight %} -- it is clearly checked whether the buffer is big enough to hold the data copied using memcpy(), but no error handling happens to avoid the memcpy() in such cases. This code path can be triggered with malicious data coming from a smartcard.

Severity

6.8 (Medium)


                    
                      CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      high

References

URL

Type

	https://ubuntu.com/security/CVE-2018-14779	REPORT
	https://www.x41-dsec.de/lab/advisories/x41-2018-0…	REPORT
	https://ubuntu.com/security/notices/USN-4276-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2018-14779	REPORT
	https://ubuntu.com/security/notices/USN-4846-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libykpiv1",
            "binary_version": "1.0.3-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "yubico-piv-tool",
            "binary_version": "1.0.3-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "yubico-piv-tool",
        "purl": "pkg:deb/ubuntu/yubico-piv-tool@1.0.3-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.3-1ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.1-1",
        "1.0.3-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libykpiv1",
            "binary_version": "1.4.2-2ubuntu0.1"
          },
          {
            "binary_name": "ykcs11",
            "binary_version": "1.4.2-2ubuntu0.1"
          },
          {
            "binary_name": "yubico-piv-tool",
            "binary_version": "1.4.2-2ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "yubico-piv-tool",
        "purl": "pkg:deb/ubuntu/yubico-piv-tool@1.4.2-2ubuntu0.1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.2-2ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.2-2"
      ]
    }
  ],
  "aliases": [],
  "details": "A buffer overflow issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `ykpiv_transfer_data()`: {% highlight c %} if(*out_len + recv_len - 2 \u003e max_out) { fprintf(stderr, \"Output buffer to small, wanted to write %lu, max was %lu.\", *out_len + recv_len - 2, max_out); } if(out_data) { memcpy(out_data, data, recv_len - 2); out_data += recv_len - 2; *out_len += recv_len - 2; } {% endhighlight %} -- it is clearly checked whether the buffer is big enough to hold the data copied using `memcpy()`, but no error handling happens to avoid the `memcpy()` in such cases. This code path can be triggered with malicious data coming from a smartcard.",
  "id": "UBUNTU-CVE-2018-14779",
  "modified": "2026-04-22T07:38:42Z",
  "published": "2018-08-15T18:29:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-14779"
    },
    {
      "type": "REPORT",
      "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-001-Yubico-Piv/"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-4276-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-14779"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-4846-1"
    }
  ],
  "related": [
    "USN-4276-1",
    "USN-4846-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "high",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2018-14779"
  ]
}

ubuntu-cve-2018-14780

Vulnerability from osv_ubuntu

Published

2018-08-15 18:29

Modified

2026-04-22 07:38

Summary

Details

An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function _ykpiv_fetch_object(): {% highlight c %} if(sw == SW_SUCCESS) { size_t outlen; int offs = _ykpiv_get_length(data + 1, &outlen); if(offs == 0) { return YKPIV_SIZE_ERROR; } memmove(data, data + 1 + offs, outlen); *len = outlen; return YKPIV_OK; } else { return YKPIV_GENERIC_ERROR; } {% endhighlight %} -- in the end, a memmove() occurs with a length retrieved from APDU data. This length is not checked for whether it is outside of the APDU data retrieved. Therefore the memmove() could copy bytes behind the allocated data buffer into this buffer.

Severity

4.6 (Medium)


                    
                      CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

N/A (UNKNOWN)


                    
                      high

References

URL

Type

	https://ubuntu.com/security/CVE-2018-14780	REPORT
	https://www.x41-dsec.de/lab/advisories/x41-2018-0…	REPORT
	https://ubuntu.com/security/notices/USN-4276-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2018-14780	REPORT
	https://ubuntu.com/security/notices/USN-4846-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libykpiv1",
            "binary_version": "1.0.3-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "yubico-piv-tool",
            "binary_version": "1.0.3-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "yubico-piv-tool",
        "purl": "pkg:deb/ubuntu/yubico-piv-tool@1.0.3-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.3-1ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.1-1",
        "1.0.3-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libykpiv1",
            "binary_version": "1.4.2-2ubuntu0.1"
          },
          {
            "binary_name": "ykcs11",
            "binary_version": "1.4.2-2ubuntu0.1"
          },
          {
            "binary_name": "yubico-piv-tool",
            "binary_version": "1.4.2-2ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "yubico-piv-tool",
        "purl": "pkg:deb/ubuntu/yubico-piv-tool@1.4.2-2ubuntu0.1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.2-2ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.2-2"
      ]
    }
  ],
  "aliases": [],
  "details": "An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `_ykpiv_fetch_object()`: {% highlight c %} if(sw == SW_SUCCESS) { size_t outlen; int offs = _ykpiv_get_length(data + 1, \u0026outlen); if(offs == 0) { return YKPIV_SIZE_ERROR; } memmove(data, data + 1 + offs, outlen); *len = outlen; return YKPIV_OK; } else { return YKPIV_GENERIC_ERROR; } {% endhighlight %} -- in the end, a `memmove()` occurs with a length retrieved from APDU data. This length is not checked for whether it is outside of the APDU data retrieved. Therefore the `memmove()` could copy bytes behind the allocated data buffer into this buffer.",
  "id": "UBUNTU-CVE-2018-14780",
  "modified": "2026-04-22T07:38:42Z",
  "published": "2018-08-15T18:29:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-14780"
    },
    {
      "type": "REPORT",
      "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-001-Yubico-Piv/"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-4276-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-14780"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-4846-1"
    }
  ],
  "related": [
    "USN-4276-1",
    "USN-4846-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "high",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2018-14780"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

usn-4276-1

Vulnerability from osv_ubuntu

ubuntu-cve-2018-14779

Vulnerability from osv_ubuntu

ubuntu-cve-2018-14780

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature