處理空的 SSLv2 訊息時發生 NULL 指標解除參照：

在 NSS 處理無效 SSLv2 訊息的方式中，發現一個 NULL 指標解除參照缺陷。攻擊者可利用此缺陷，損毀依據 NSS 程式庫編譯的伺服器應用程式。(CVE-2017-7502)

CVE-2017-7502 發現當伺服器接收空白的 SSLv2 訊息時，NSS 中會出現 NULL 指標解除參照弱點。此問題是因為最近將 3.24.0 版中上游程式碼的 SSLv2 通訊協定移除，且加入只能處理 sslv2 型態之 hello 訊息的專用剖析器所造成的。針對 Debian 7「Wheezy」，此問題已在 2:3.26-1+debu7u4 版本中修正。建議您升級 nss 套件。注意：Tenable Network Security 已直接從 DLA 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

在密碼編譯程式庫集 NSS 中發現數個弱點，可能會造成拒絕服務或資訊洩漏。

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-1365 advisory.

    [3.28.4-1.2.0.1]
    - Added nss-vendor.patch to change vendor

    [3.28.4-1.2]
    - Include CKBI 2.14 and updated CA constraints from NSS 3.28.5

    [3.28.4-1.1]
    - Fix zero-length record treatment in SSL3_GatherData

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3336-1 advisory.

    It was discovered that NSS incorrectly handled certain empty SSLv2 messages. A remote attacker could     possibly use this issue to cause NSS to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2     messages resulting into denial of service by remote attacker. (CVE-2017-7502)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update for nss is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.

Security Fix(es) :

* A NULL pointer dereference flaw was found in the way NSS handled empty SSLv2 messages. An attacker could use this flaw to crash a server application compiled against the NSS library. (CVE-2017-7502)

Bug Fix(es) :

* The Network Security Services (NSS) code and Certificate Authority (CA) list have been updated to meet the recommendations as published with the latest Mozilla Firefox Extended Support Release (ESR). The updated CA list improves compatibility with the certificates that are used in the Internet Public Key Infrastructure (PKI). To avoid certificate validation refusals, Red Hat recommends installing the updated CA list on June 12, 2017. (BZ# 1448488)

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for nss is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.

Security Fix(es) :

* A NULL pointer dereference flaw was found in the way NSS handled empty SSLv2 messages. An attacker could use this flaw to crash a server application compiled against the NSS library. (CVE-2017-7502)

Bug Fix(es) :

* The Network Security Services (NSS) code and Certificate Authority (CA) list have been updated to meet the recommendations as published with the latest Mozilla Firefox Extended Support Release (ESR). The updated CA list improves compatibility with the certificates that are used in the Internet Public Key Infrastructure (PKI). To avoid certificate validation refusals, Red Hat recommends installing the updated CA list on June 12, 2017. (BZ# 1451421)

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - A NULL pointer dereference flaw was found in the way NSS     handled empty SSLv2 messages. An attacker could use this     flaw to crash a server application compiled against the     NSS library. (CVE-2017-7502)

Bug Fix(es) :

  - The Network Security Services (NSS) code and Certificate     Authority (CA) list have been updated to meet the     recommendations as published with the latest Mozilla     Firefox Extended Support Release (ESR). The updated CA     list improves compatibility with the certificates that     are used in the Internet Public Key Infrastructure     (PKI). To avoid certificate validation refusals,     consider installing the updated CA list on June 12,     2017.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
101001	Amazon Linux AMI：nss (ALAS-2017-848)	Nessus	Amazon Linux Local Security Checks	2017/6/23	2025/12/15	high
100559	Debian DLA-971-1：nss 安全性更新	Nessus	Debian Local Security Checks	2017/6/1	2025/12/17	high
100580	Debian DSA-3872-1：nss - 安全性更新	Nessus	Debian Local Security Checks	2017/6/2	2025/12/17	critical
100526	Oracle Linux 7 : nss (ELSA-2017-1365)	Nessus	Oracle Linux Local Security Checks	2017/5/31	2024/11/1	high
100988	Ubuntu 14.04 LTS / 16.04 LTS : NSS vulnerability (USN-3336-1)	Nessus	Ubuntu Local Security Checks	2017/6/22	2024/8/27	high
221690	Linux Distros Unpatched Vulnerability : CVE-2017-7502	Nessus	Misc.	2025/3/4	2025/3/4	high
101475	Virtuozzo 6 : nss / nss-devel / nss-pkcs11-devel / nss-sysinit / etc (VZLSA-2017-1364)	Nessus	Virtuozzo Local Security Checks	2017/7/13	2025/12/11	high
101476	Virtuozzo 7 : nss / nss-devel / nss-pkcs11-devel / nss-sysinit / etc (VZLSA-2017-1365)	Nessus	Virtuozzo Local Security Checks	2017/7/13	2025/12/11	high
100536	Scientific Linux Security Update : nss on SL7.x x86_64 (20170530)	Nessus	Scientific Linux Local Security Checks	2017/5/31	2025/12/17	high

检测

插件搜索

high

high

critical

high

high

high

high

high

high