CVE-2009-0368
OpenSC < 0.11.7 - Unauthenticated Private Data Object Read via Low-Level APDU Command
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2009-0368. PoCs published by Andreas Jellinghaus.
AI-analyzed exploit summary This exploit demonstrates an unauthorized access vulnerability in OpenSC prior to version 0.11.7. It involves creating a secret file, initializing a blank card, writing a private data object, and accessing it using low-level tools, bypassing intended access controls.
Description
OpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements and read private data objects via a (1) low level APDU command or (2) debugging tool, as demonstrated by reading the 4601 or 4701 file with the opensc-explorer or opensc-tool program.
Exploits (1)
This exploit demonstrates an unauthorized access vulnerability in OpenSC prior to version 0.11.7. It involves creating a secret file, initializing a blank card, writing a private data object, and accessing it using low-level tools, bypassing intended access controls.