CVE: CVE-2009-1603

Export to Word

src/tools/pkcs11-tool.c in pkcs11-tool in OpenSC 0.11.7, when used with unspecified third-party PKCS#11 modules, generates RSA keys with incorrect public exponents, which allows attackers to read the cleartext form of messages that were intended to be encrypted.

Threat-Mapped Scoring

Score: 0.0

Priority: Unclassified

EPSS

Score: 0.0105
Percentile: 0.76597

CVSS Scoring

CVSS v3.1 Score: 7.5

Severity: HIGH

Mapped CWE(s)

CWE-312 : Cleartext Storage of Sensitive Information

All CAPEC(s)

CAPEC-37: Retrieve Embedded Sensitive Data

CAPEC(s) with Mapped TTPs

CAPEC-37: Retrieve Embedded Sensitive Data
Mapped TTPs:
- T1005 : Data from Local System
- T1552.004 : Private Keys

Mapped ATT&CK TTPs

T1005 : Data from Local System
Kill Chain: collection
T1552.004 : Private Keys
Kill Chain: credential-access

Malware

APTs Threat Group Associations

Campaigns

Operation Wocao
SolarWinds Compromise
Operation CuckooBees
CostaRicto
Operation Honeybee
Operation Dream Job
C0015
Frankenstein
Night Dragon
Operation MidnightEclipse
C0017
Cutting Edge
C0026

Affected Products

cpe:2.3:a:opensc-project:opensc:0.11.7:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:*

← Back to Home