The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-538:03 advisory.

    Description :
    Network Security Services (NSS) is a set of libraries designed to     support cross-platform development of security-enabled client and     server applications. Applications built with NSS can support SSL v2     and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509     v3 certificates, and other security standards.
    Security issues fixed with this release:
    CVE-2013-1740     The ssl_Do1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services (NSS) before     3.15.4, when the TLS False Start feature is enabled, allows man-in-the-middle attackers to spoof SSL     servers by using an arbitrary X.509 certificate during certain handshake traffic.
    CVE-2014-1490     Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla     Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and     other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have     unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement     of a session ticket.
    CVE-2014-1491     Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR     24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly     restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote attackers to     bypass cryptographic protection mechanisms in ticket handling by leveraging use of a certain value.
    CVE-2014-1492     The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in     Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an     internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL     servers via a crafted certificate.
    CVE-2014-1545     Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code     or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console     functions.
    fixed bugs;
    * Previously, the shell in the Network Security Services (NSS) specification handled test failures     incorrectly as false positive test results, when the output.log file was not present on the system. So,     certain utilities, such as grep, could not handle failures properly. With this update, fixed it.
    * Previously, a subordinate Certificate Authority (CA) of the ANSSI agency incorrectly issued an     intermediate certificate installed on a network monitoring device. So, the monitoring device was enabled     to act as an MITM (Man in the Middle) proxy performing traffic management of domain names or IP addresses     that the certificate holder did not own or control. The trust in the intermediate certificate to issue the     certificate for an MITM device has been revoked, and such a device can no longer be used for MITM attacks.
    * Previously,  MD5 certificates were rejected by default because Network Security Services (NSS) did not     trust MD5 certificates. With this update, fixed it.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2013-1740 The ssl_Do1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services (NSS) before 3.15.4, when the TLS False Start feature is enabled, allows man-in-the-middle attackers to spoof SSL servers by using an arbitrary X.509 certificate during certain handshake traffic.

CVE-2014-1490 Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket.

CVE-2014-1491 Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote attackers to bypass cryptographic protection mechanisms in ticket handling by leveraging use of a certain value.

CVE-2014-1492 The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is iframeded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate.

CVE-2014-1544 Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain.

CVE-2014-1545 Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console functions.

The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, Thunderbird,       and SeaMonkey. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms,  or have other unspecified       impact.
  Workaround :

    There are no known workarounds at this time.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
290054	MiracleLinux 3 : nss-3.16.1-2.AXS3 (AXSA:2014-538:03)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
91202	F5 Networks BIG-IP : Multiple Mozilla NSS vulnerabilities (K16716)	Nessus	F5 Networks Local Security Checks	2016/5/18	2021/3/10	critical
82632	GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2015/4/8	2021/1/11	critical

检测

插件搜索

critical

critical

critical