Security Fix(es) :

  - A NULL pointer dereference flaw was found in the way NSS     handled empty SSLv2 messages. An attacker could use this     flaw to crash a server application compiled against the     NSS library. (CVE-2017-7502)

Bug Fix(es) :

  - The Network Security Services (NSS) code and Certificate     Authority (CA) list have been updated to meet the     recommendations as published with the latest Mozilla     Firefox Extended Support Release (ESR). The updated CA     list improves compatibility with the certificates that     are used in the Internet Public Key Infrastructure     (PKI). To avoid certificate validation refusals,     consider installing the updated CA list on June 12,     2017.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3336-1 advisory.

    It was discovered that NSS incorrectly handled certain empty SSLv2 messages. A remote attacker could     possibly use this issue to cause NSS to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for nss is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.

Security Fix(es) :

* A NULL pointer dereference flaw was found in the way NSS handled empty SSLv2 messages. An attacker could use this flaw to crash a server application compiled against the NSS library. (CVE-2017-7502)

Bug Fix(es) :

* The Network Security Services (NSS) code and Certificate Authority (CA) list have been updated to meet the recommendations as published with the latest Mozilla Firefox Extended Support Release (ESR). The updated CA list improves compatibility with the certificates that are used in the Internet Public Key Infrastructure (PKI). To avoid certificate validation refusals, Red Hat recommends installing the updated CA list on June 12, 2017. (BZ# 1448488)

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for nss is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.

Security Fix(es) :

* A NULL pointer dereference flaw was found in the way NSS handled empty SSLv2 messages. An attacker could use this flaw to crash a server application compiled against the NSS library. (CVE-2017-7502)

Bug Fix(es) :

* The Network Security Services (NSS) code and Certificate Authority (CA) list have been updated to meet the recommendations as published with the latest Mozilla Firefox Extended Support Release (ESR). The updated CA list improves compatibility with the certificates that are used in the Internet Public Key Infrastructure (PKI). To avoid certificate validation refusals, Red Hat recommends installing the updated CA list on June 12, 2017. (BZ# 1451421)

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2     messages resulting into denial of service by remote attacker. (CVE-2017-7502)

Note that Nessus relies on the presence of the package as reported by the vendor.

來自 Red Hat 安全公告 2017:1364： 現已提供適用於 Red Hat Enterprise Linux 6 的 nss 更新。 Red Hat 產品安全性團隊已將此更新評等為具有重要安全性影響。可從〈參照〉一節的 CVE 連結中取得每個弱點之常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。 Network Security Services (NSS) 是一組程式庫，專用於支援啟用安全性之用戶端及伺服器應用程式的跨平台開發。 安全性修正： * 在 NSS 處理空的 SSLv2 訊息的方式中，發現一個 null 指標解除參照缺陷。攻擊者可利用此缺陷，損毀依據 NSS 程式庫編譯的伺服器應用程式。(CVE-2017-7502) 錯誤修正： * 已更新 Network Security Services (NSS) 程式碼及授權單位 (CA) 清單，以符合最新 Mozilla Firefox Extended Support Release (ESR) 發佈的建議。更新的 CA 清單提高了與網際網路公開金鑰基礎結構 (PKI) 中所用憑證的相容性。為了避免憑證驗證遭拒，Red Hat 建議您安裝 2017 年 6 月 12 日發佈的更新 CA 清單。(BZ# 1448488)

現已提供適用於 Red Hat Enterprise Linux 6 的 nss 更新。Red Hat 產品安全性團隊已將此更新評等為具有重要安全性影響。可從〈參照〉一節的 CVE 連結中取得每個弱點之常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。Network Security Services (NSS) 是一組程式庫，專用於支援啟用安全性之用戶端及伺服器應用程式的跨平台開發。安全性修正：* 在 NSS 處理無效 SSLv2 訊息的方式中，發現一個 NULL 指標解除參照缺陷。攻擊者可利用此缺陷，損毀依據 NSS 程式庫編譯的伺服器應用程式。(CVE-2017-7502) 錯誤修正：* 已更新 Network Security Services (NSS) 程式碼及授權單位 (CA) 清單，以符合最新 Mozilla Firefox Extended Support Release (ESR) 發佈的建議。更新的 CA 清單提高了與網際網路公開金鑰基礎結構 (PKI) 中所用憑證的相容性。為了避免憑證驗證遭拒，Red Hat 建議您安裝 2017 年 6 月 12 日發佈的更新 CA 清單。(BZ#1448488)

安全性修正：- 在 NSS 處理空的 SSLv2 訊息的方式中，發現一個 NULL 指標解除參照缺陷。攻擊者可利用此缺陷，損毀依據 NSS 程式庫編譯的伺服器應用程式。(CVE-2017-7502) 錯誤修正：- 已更新 Network Security Services (NSS) 程式碼及授權單位 (CA) 清單，以符合最新 Mozilla Firefox Extended Support Release (ESR) 發佈的建議。更新的 CA 清單提高了與網際網路公開金鑰基礎結構 (PKI) 中所用憑證的相容性。為了避免憑證驗證遭拒，請考慮安裝 2017 年 6 月 12 日發佈的更新 CA 清單。

執行 MAIN 4.05 版的遠端 NewStart CGSL 主機安裝了受多個弱點影響的 nss 套件：- 在 NSS 執行特定 Base64 解碼作業的方式中，發現一個越界寫入缺陷。攻擊者可利用此缺陷建立特製的憑證，當由 NSS 剖析時，可造成其損毀，或使用執行針對 NSS 程式庫編譯之應用程式的使用者權限執行任意程式碼。(CVE-2017-5461) - 在 NSS 處理空的 SSLv2 訊息的方式中，發現一個 null 指標解除參照缺陷。攻擊者可利用此缺陷，損毀依據 NSS 程式庫編譯的伺服器應用程式。(CVE-2017-7502) 請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
100536	Scientific Linux Security Update : nss on SL7.x x86_64 (20170530)	Nessus	Scientific Linux Local Security Checks	2017/5/31	2021/1/14	high
100988	Ubuntu 14.04 LTS / 16.04 LTS : NSS vulnerability (USN-3336-1)	Nessus	Ubuntu Local Security Checks	2017/6/22	2024/8/27	high
101475	Virtuozzo 6 : nss / nss-devel / nss-pkcs11-devel / nss-sysinit / etc (VZLSA-2017-1364)	Nessus	Virtuozzo Local Security Checks	2017/7/13	2021/1/4	high
101476	Virtuozzo 7 : nss / nss-devel / nss-pkcs11-devel / nss-sysinit / etc (VZLSA-2017-1365)	Nessus	Virtuozzo Local Security Checks	2017/7/13	2021/1/4	high
221690	Linux Distros Unpatched Vulnerability : CVE-2017-7502	Nessus	Misc.	2025/3/4	2025/3/4	high
100525	Oracle Linux 6：nss (ELSA-2017-1364)	Nessus	Oracle Linux Local Security Checks	2017/5/31	2024/10/22	high
100531	RHEL 6：nss (RHSA-2017:1364)	Nessus	Red Hat Local Security Checks	2017/5/31	2024/11/4	high
100535	Scientific Linux 安全性更新：SL6.x i386/x86_64 上的 nss	Nessus	Scientific Linux Local Security Checks	2017/5/31	2021/1/14	high
127337	NewStart CGSL MAIN 4.05：nss 多個弱點 (NS-SA-2019-0105)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2021/1/14	critical

检测

插件搜索

high

high

high

high

high

high

high

high

critical