[ MDVSA-2009:123 ] opensc

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mandriva Linux Security Advisory MDVSA-2009:123
http://www.mandriva.com/security/

Package : opensc
Date : May 27, 2009
Affected: 2009.1

Problem Description:

src/tools/pkcs11-tool.c in pkcs11-tool in OpenSC 0.11.7, when used
with unspecified third-party PKCS#11 modules, generates RSA keys
with incorrect public exponents, which allows attackers to read
the cleartext form of messages that were intended to be encrypted
(CVE-2009-1603).

The updated packages fix the issue.

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1603

Updated Packages:

Mandriva Linux 2009.1:
93d931f0429e33b4cfa8afc4e318e62b 2009.1/i586/libopensc2-0.11.7-1.2mdv2009.1.i586.rpm
6d8c099c4de3b3af319ece59d077779f 2009.1/i586/libopensc-devel-0.11.7-1.2mdv2009.1.i586.rpm
c90bfd05585e2fb085ae163845fb73da 2009.1/i586/mozilla-plugin-opensc-0.11.7-1.2mdv2009.1.i586.rpm
db9f05b26f7518415312b632d4be98ed 2009.1/i586/opensc-0.11.7-1.2mdv2009.1.i586.rpm
27a21b5fcf9e2249480132a536595e56 2009.1/SRPMS/opensc-0.11.7-1.2mdv2009.1.src.rpm

Mandriva Linux 2009.1/X86_64:
03fe16d970157ab33ab4b794d43b8b93 2009.1/x86_64/lib64opensc2-0.11.7-1.2mdv2009.1.x86_64.rpm
29ed791ed3bf95d241868f6b785f08d2 2009.1/x86_64/lib64opensc-devel-0.11.7-1.2mdv2009.1.x86_64.rpm
676798a2d6346adb036bc467f8ac0d8b
2009.1/x86_64/mozilla-plugin-opensc-0.11.7-1.2mdv2009.1.x86_64.rpm
6fc6703c378a8f08b96f9df540d413fe 2009.1/x86_64/opensc-0.11.7-1.2mdv2009.1.x86_64.rpm
27a21b5fcf9e2249480132a536595e56 2009.1/SRPMS/opensc-0.11.7-1.2mdv2009.1.src.rpm

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFKHWZimqjQ0CJFipgRAqfRAJwNloJBbN1Znw3KRariLk5fHOy6RwCg7a3g
WzoT4aCBDHQVL2guqNiNhGw=
=Vh+W
-----END PGP SIGNATURE-----