CVE-2008-2235
Estado: ModificadaMedia (4.9)—
OpenSC before 0.11.5 uses weak permissions (ADMIN file control information of 00) for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proximate attackers to change the PIN.
CVSS
- Versión: 2.0
- Vector: AV:L/AC:L/Au:N/C:N/I:C/A:N
- Puntuación base: 4.9
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.39%
- Percentil entre todas las CVEs puntuadas: 31
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-310
Referencias
- http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
- http://secunia.com/advisories/31330
- http://secunia.com/advisories/31360
- http://secunia.com/advisories/32099
- http://secunia.com/advisories/33115
- http://secunia.com/advisories/34362
- http://security.gentoo.org/glsa/glsa-200812-09.xml
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:183
- http://www.opensc-project.org/pipermail/opensc-announce/2008-July/000020.html
- http://www.opensc-project.org/security.html
- http://www.securityfocus.com/bid/30473
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44140
- https://www.debian.org/security/2008/dsa-1627
- https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00686.html
- http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
- http://secunia.com/advisories/31330
- http://secunia.com/advisories/31360
- http://secunia.com/advisories/32099
- http://secunia.com/advisories/33115
- http://secunia.com/advisories/34362
- http://security.gentoo.org/glsa/glsa-200812-09.xml
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:183
- http://www.opensc-project.org/pipermail/opensc-announce/2008-July/000020.html
- http://www.opensc-project.org/security.html
- http://www.securityfocus.com/bid/30473
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44140
- https://www.debian.org/security/2008/dsa-1627
- https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00686.html
JSON original (NVD)
Mostrar
{
"id": "CVE-2008-2235",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.9,
"accessVector": "LOCAL",
"vectorString": "AV:L/AC:L/Au:N/C:N/I:C/A:N",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 6.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 3.9,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2008-08-01T14:41:00.000",
"references": [
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00005.html",
"source": "cve@mitre.org"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/31330",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/31360",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/32099",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/33115",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/34362",
"source": "cve@mitre.org"
},
{
"url": "http://security.gentoo.org/glsa/glsa-200812-09.xml",
"source": "cve@mitre.org"
},
{
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:183",
"source": "cve@mitre.org"
},
{
"url": "http://www.opensc-project.org/pipermail/opensc-announce/2008-July/000020.html",
"source": "cve@mitre.org"
},
{
"url": "http://www.opensc-project.org/security.html",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/30473",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44140",
"source": "cve@mitre.org"
},
{
"url": "https://www.debian.org/security/2008/dsa-1627",
"source": "cve@mitre.org"
},
{
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00686.html",
"source": "cve@mitre.org"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00005.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/31330",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/31360",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/32099",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/33115",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/34362",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://security.gentoo.org/glsa/glsa-200812-09.xml",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:183",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.opensc-project.org/pipermail/opensc-announce/2008-July/000020.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.opensc-project.org/security.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/30473",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44140",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.debian.org/security/2008/dsa-1627",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00686.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-310"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSC before 0.11.5 uses weak permissions (ADMIN file control information of 00) for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proximate attackers to change the PIN."
},
{
"lang": "es",
"value": "OpenSC anterior a 0.11.5 usa permisos débiles (archivo de control de información ADMIN de 00) para el directorio 5015 en smart cards y crypto tokens USB ejecutándose Siemens CardOS M4, que permite a atacantes próximos físicamente cambiar el PIN."
}
],
"lastModified": "2026-06-16T22:53:22.540",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:cardos:m4:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "FEF8B710-EAF0-4381-B1C5-B2EAA91737DE"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opensc-project:opensc:0.3.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7D734B35-BA7F-4219-98DA-FCD55E5A37C0"
},
{
"criteria": "cpe:2.3:a:opensc-project:opensc:0.3.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "349D5BCA-885C-4948-838E-E3904E49598E"
},
{
"criteria": "cpe:2.3:a:opensc-project:opensc:0.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "471DBF4E-54B8-4776-A0BA-0F65FE02192E"
},
{
"criteria": "cpe:2.3:a:opensc-project:opensc:0.6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EA4321E6-1D08-489C-948F-2673C30D762C"
},
{
"criteria": "cpe:2.3:a:opensc-project:opensc:0.6.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8498096A-19A9-4C09-99C3-CC1C45D6BA40"
},
{
"criteria": "cpe:2.3:a:opensc-project:opensc:0.7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5028CF13-2807-4813-A542-A1CD6E735CC5"
},
{
"criteria": "cpe:2.3:a:opensc-project:opensc:0.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8FD4CB51-068C-4AD2-94AC-59DE20A2AB77"
},
{
"criteria": "cpe:2.3:a:opensc-project:opensc:0.8.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2D8CA0B8-AC3B-4D0F-854D-EDF285EC01CD"
},
{
"criteria": "cpe:2.3:a:opensc-project:opensc:0.8.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "931CE287-97AF-4B73-BA57-FB9B9AAA7016"
},
{
"criteria": "cpe:2.3:a:opensc-project:opensc:0.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2BA979A3-A34F-4813-8489-C1985E22A398"
},
{
"criteria": "cpe:2.3:a:opensc-project:opensc:0.9.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6A64E85D-B1A7-48FB-8438-8173249ED817"
},
{
"criteria": "cpe:2.3:a:opensc-project:opensc:0.9.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "940151B8-6466-43D7-A7EB-A28F13DA5B50"
},
{
"criteria": "cpe:2.3:a:opensc-project:opensc:0.9.7:b:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0BE84E1D-F765-49E6-84E2-6831A535B67A"
},
{
"criteria": "cpe:2.3:a:opensc-project:opensc:0.9.7:d:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CE85FABD-20F0-4308-B240-0E460E85CA08"
},
{
"criteria": "cpe:2.3:a:opensc-project:opensc:0.9.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3752BA88-CA7A-4B79-96C4-A5EC9A6C2AC3"
},
{
"criteria": "cpe:2.3:a:opensc-project:opensc:0.11.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B093D7C9-242E-4CC7-9971-71D9AE19A7F7"
},
{
"criteria": "cpe:2.3:a:opensc-project:opensc:0.11.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "353AFA23-88C0-45AA-B9EF-EF7A4DC6AFE3"
},
{
"criteria": "cpe:2.3:a:opensc-project:opensc:0.11.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EA2024C5-238A-4734-B8C6-D4F99EEFBC07"
},
{
"criteria": "cpe:2.3:a:opensc-project:opensc:0.11.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DF611D89-FA24-4421-A8A8-5290629C81D1"
},
{
"criteria": "cpe:2.3:a:opensc-project:opensc:0.11.3:pre3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0ECCFF79-6515-42F8-B986-4C06BE1F79D6"
},
{
"criteria": "cpe:2.3:a:opensc-project:opensc:0.11.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A74B19CB-8AFB-4A07-9A84-063BFF47E089"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"vendorComments": [
{
"comment": "Siemens has analyzed this report and states that no security breach can be found in the Siemens CardOS M4 itself and it thus does not relate to any Siemens component. The reported vulnerability (caused by inappropriate personalization) is due to an issue in the OPENSC middleware detailed information can be found under http://www.opensc-project.org/security.html. \n\nTherefore, Siemens recommends all customers and partners using OPENSC to use either the current version 0.11.5 of OPENSC in which this vulnerability is fixed or to use the bug fix suggested under http://freshmeat.net/articles/view/3333/. \n\nWe hope that we could help you with this recommendation. \n\nIf you have further questions, please contact the Siemens CardOS hotline under:\n\nscs-support.med@siemens.com\n\nPhone: +49 89 636 35996 (Mo.-Fr. 9:00-17:00 German time)\n\n",
"lastModified": "2008-08-14T00:00:00",
"organization": "Siemens"
}
],
"sourceIdentifier": "cve@mitre.org"
}