Multiple vulnerabilities has been found and corrected in the Mozilla NSS and NSPR packages :

The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate (CVE-2014-1492).

Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain (CVE-2014-1544).

Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1, Google Chrome before 37.0.2062.124 on Windows and OS X, and Google Chrome OS before 37.0.2062.120, does not properly parse ASN.1 values in X.509 certificates, which makes it easier for remote attackers to spoof RSA signatures via a crafted certificate, aka a signature malleability issue (CVE-2014-1568).

The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00 (CVE-2014-1569).

Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console functions (CVE-2014-1545).

The sqlite3 packages have been upgraded to the 3.8.6 version due to an prerequisite to nss-3.17.x.

Additionally the rootcerts package has also been updated to the latest version as of 2014-11-17, which adds, removes, and distrusts several certificates.

The updated packages provides a solution for these security issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0917 advisory.

    nspr     [4.10.6-1]
    - Rebase to nspr-4.10.6
    - Resolves: rhbz#1112135

    nss     [3.16.1-4.0.1.el6_5]
    - Added nss-vendor.patch to change vendor

    [3.16.1-4]
    - Update some patches on account of the rebase
    - Resolves: Bug 1099619

    [3.16.1-3]
    - Backport nss-3.12.6 upstream fix required by Firefox 31
    - Resolves: Bug 1099619

    [3.16.1-2]
    - Remove two unused patches and apply a needed one that was missed
    - Resolves: Bug 1112136 - Rebase nss in RHEL 6.5.Z to NSS 3.16.1

    [3.16.1-1]
    - Update to nss-3.16.1
    - Resolves: Bug 1112136 - Rebase nss in RHEL 6.5.Z to NSS 3.16.1

    nss-util     [3.15.6-1]
    - Update to nss-3.16.1
    - Resolves: rhbz#1112136

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote host is a version prior to 31.0. It is, therefore, affected by the following vulnerabilities :

  - When a pair of NSSCertificate structures are added to a     trust domain and then one of them is removed during use,     a use-after-free error occurs which may cause the     application to crash. This crash is potentially     exploitable. (CVE-2014-1544)

  - There are multiple memory safety hazards within the     browser engine. These hazards may lead to memory     corruption vulnerabilities, which may allow attackers     to execute arbitrary code. (CVE-2014-1547,     CVE-2014-1548)

  - A buffer overflow exists when interacting with the Web     Audio buffer during playback due to an error with the     allocation of memory for the buffer. This may lead to     a potentially exploitable crash. (CVE-2014-1549)

  - A use-after-free exists in Web Audio due to the way     control messages are handled. This may lead to a     potentially exploitable crash. (CVE-2014-1550)

  - There is a potential use-after-free issue in     DirectWrite font handling. This may allow an attacker     to potentially execute arbitrary code within the context     of the user running the application. (CVE-2014-1551)

  - There is an issue with the IFRAME sandbox same-origin     access policy which allows sandboxed content to access     other content from the same origin without approval.
    This may lead to a same-origin-bypass vulnerability.
    (CVE-2014-1552)

  - Triggering the FireOnStateChange event has the     potential to crash the application. This may lead to     a use-after-free and an exploitable crash.
    (CVE-2014-1555)

  - When using the Cesium JavaScript library to generate     WebGL content, the application may crash. This crash     is potentially exploitable. (CVE-2014-1556)

  - There is a flaw in the Skia library when scaling images     of high quality. If the image data is discarded while     being processed, the library may crash. This crash     is potentially exploitable. (CVE-2014-1557)

  - There are multiple issues with using invalid     characters in various certificates. These invalid     characters may cause certificates to be parsed     incorrectly which may lead to the inability to use     valid SSL certificates. (CVE-2014-1558, CVE-2014-1559,     CVE-2014-1560)

  - It may be possible to spoof drag and drop events in     web content. This may allow limited ability to interact     with the UI. (CVE-2014-1561)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:0915 advisory.

    Network Security Services (NSS) is a set of libraries designed to support     the cross-platform development of security-enabled client and server     applications.

    A race condition was found in the way NSS verified certain certificates.
    A remote attacker could use this flaw to crash an application using NSS or,     possibly, execute arbitrary code with the privileges of the user running     that application. (CVE-2014-1544)

    Red Hat would like to thank the Mozilla project for reporting     CVE-2014-1544. Upstream acknowledges Tyson Smith and Jesse Schwartzentruber     as the original reporters.

    Users of NSS are advised to upgrade to these updated packages, which     correct this issue. After installing this update, applications using NSS     must be restarted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

In nss, a set of libraries designed to support cross-platform development of security-enabled client and server applications, Tyson Smith and Jesse Schwartzentruber discovered a use-after-free vulnerability that allows remote attackers to execute arbitrary code by triggering the improper removal of an NSSCertificate structure from a trust domain.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated nss and nspr packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities.

A race condition was found in the way NSS verified certain certificates. A remote attacker could use this flaw to crash an application using NSS or, possibly, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1544)

A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server. (CVE-2013-1740)

A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application.
(CVE-2014-1490)

It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server. (CVE-2014-1491)

An out-of-bounds write flaw was found in NSPR. A remote attacker could potentially use this flaw to crash an application using NSPR or, possibly, execute arbitrary code with the privileges of the user running that application. This NSPR flaw was not exposed to web content in any shipped version of Firefox. (CVE-2014-1545)

It was found that the implementation of Internationalizing Domain Names in Applications (IDNA) hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid.
(CVE-2014-1492)

Red Hat would like to thank the Mozilla project for reporting the CVE-2014-1544, CVE-2014-1490, CVE-2014-1491, and CVE-2014-1545 issues.
Upstream acknowledges Tyson Smith and Jesse Schwartzentruber as the original reporters of CVE-2014-1544, Brian Smith as the original reporter of CVE-2014-1490, Antoine Delignat-Lavaud and Karthikeyan Bhargavan as the original reporters of CVE-2014-1491, and Abhishek Arya as the original reporter of CVE-2014-1545.

In addition, the nss package has been upgraded to upstream version 3.16.1, and the nspr package has been upgraded to upstream version 4.10.6. These updated packages provide a number of bug fixes and enhancements over the previous versions. (BZ#1112136, BZ#1112135)

Users of NSS and NSPR are advised to upgrade to these updated packages, which correct these issues and add these enhancements. After installing this update, applications using NSS or NSPR must be restarted for this update to take effect.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
81942	Mandriva Linux Security Advisory : nss (MDVSA-2015:059)	Nessus	Mandriva Local Security Checks	2015/3/19	2021/1/6	critical
76694	Oracle Linux 6 : nss / and / nspr (ELSA-2014-0917)	Nessus	Oracle Linux Local Security Checks	2014/7/23	2024/10/23	critical
76763	Firefox < 31.0 Multiple Vulnerabilities	Nessus	Windows	2014/7/24	2026/6/23	critical
79110	RHEL 6 : nss (RHSA-2014:0915)	Nessus	Red Hat Local Security Checks	2014/11/11	2025/4/15	high
82234	Debian DLA-89-1 : nss security update	Nessus	Debian Local Security Checks	2015/3/26	2021/1/11	critical
76686	CentOS 6 : nspr / nss / nss-util (CESA-2014:0917)	Nessus	CentOS Local Security Checks	2014/7/23	2021/1/4	critical

检测

插件搜索

critical

critical

critical

high

critical

critical